dcrat | 93fe21dbb3bb181c61b9c3f40abd04130f83bf7ce906ba73394045896c5019fc

pid	Process
780	chrome.exe
1596	chrome.exe
4684	chrome.exe
4268	chrome.exe
932	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Control Panel\International\Geo\Nation	Webruntime.exe

Executes dropped EXE 4 IoCs

pid	Process
32	1.exe
3708	2.exe
5244	Webruntime.exe
5832	System.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	ipinfo.io
8	ipinfo.io
15	ip-api.com

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows Defender\fr-FR\OfficeClickToRun.exe	Webruntime.exe
File created	C:\Program Files (x86)\Windows Defender\fr-FR\e6c9b481da804f	Webruntime.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
5820	cmd.exe
4504	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	1.exe

Delays execution with timeout.exe 25 IoCs

defense_evasion

pid	Process
1808	timeout.exe
4312	timeout.exe
2456	timeout.exe
4544	timeout.exe
1240	timeout.exe
4112	timeout.exe
5604	timeout.exe
4740	timeout.exe
4792	timeout.exe
5556	timeout.exe
3964	timeout.exe
2384	timeout.exe
4552	timeout.exe
1560	timeout.exe
5116	timeout.exe
3396	timeout.exe
1860	timeout.exe
3984	timeout.exe
5304	timeout.exe
2616	timeout.exe
888	timeout.exe
5108	timeout.exe
4012	timeout.exe
736	timeout.exe
4776	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
5332	taskkill.exe
5356	taskkill.exe
6116	taskkill.exe
4264	taskkill.exe
4876	taskkill.exe
3416	taskkill.exe
3908	taskkill.exe
4080	taskkill.exe
1696	taskkill.exe
4428	taskkill.exe
1640	taskkill.exe
1968	taskkill.exe
628	taskkill.exe
2236	taskkill.exe
2016	taskkill.exe
408	taskkill.exe
2576	taskkill.exe
5988	taskkill.exe
4556	taskkill.exe
1640	taskkill.exe
5684	taskkill.exe
3424	taskkill.exe
4200	taskkill.exe
1836	taskkill.exe
116	taskkill.exe
2308	taskkill.exe
2468	taskkill.exe
1248	taskkill.exe
3196	taskkill.exe
3152	taskkill.exe
180	taskkill.exe
5412	taskkill.exe
5184	taskkill.exe
1668	taskkill.exe
4832	taskkill.exe
4520	taskkill.exe
5936	taskkill.exe
1488	taskkill.exe
5328	taskkill.exe
4504	taskkill.exe
5236	taskkill.exe
5016	taskkill.exe
1868	taskkill.exe
5008	taskkill.exe
3048	taskkill.exe
3668	taskkill.exe
4916	taskkill.exe
4784	taskkill.exe
2560	taskkill.exe
1684	taskkill.exe
456	taskkill.exe
316	taskkill.exe
1340	taskkill.exe
4300	taskkill.exe
1076	taskkill.exe
3776	taskkill.exe
5348	taskkill.exe
3992	taskkill.exe
5052	taskkill.exe
4848	taskkill.exe
3768	taskkill.exe
5576	taskkill.exe
1340	taskkill.exe
6040	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000_Classes\Local Settings	Webruntime.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5252	powershell.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe
5244	Webruntime.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe
4684	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	2.exe
Token: SeDebugPrivilege	5244	Webruntime.exe
Token: SeDebugPrivilege	5252	powershell.exe
Token: SeDebugPrivilege	32	1.exe
Token: SeDebugPrivilege	1180	taskkill.exe
Token: SeDebugPrivilege	3628	taskkill.exe
Token: SeDebugPrivilege	5484	taskkill.exe
Token: SeDebugPrivilege	2308	taskkill.exe
Token: SeDebugPrivilege	4492	taskkill.exe
Token: SeDebugPrivilege	4024	taskkill.exe
Token: SeDebugPrivilege	5760	taskkill.exe
Token: SeDebugPrivilege	620	taskkill.exe
Token: SeDebugPrivilege	5576	taskkill.exe
Token: SeDebugPrivilege	976	taskkill.exe
Token: SeDebugPrivilege	5832	System.exe
Token: SeDebugPrivilege	1044	taskkill.exe
Token: SeDebugPrivilege	6036	taskkill.exe
Token: SeDebugPrivilege	1640	taskkill.exe
Token: SeDebugPrivilege	1492	taskkill.exe
Token: SeDebugPrivilege	1608	taskkill.exe
Token: SeDebugPrivilege	3196	taskkill.exe
Token: SeDebugPrivilege	4320	taskkill.exe
Token: SeDebugPrivilege	1040	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	4816	taskkill.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeShutdownPrivilege	4684	chrome.exe
Token: SeCreatePagefilePrivilege	4684	chrome.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	3848	taskkill.exe
Token: SeDebugPrivilege	888	taskkill.exe
Token: SeDebugPrivilege	5224	taskkill.exe
Token: SeDebugPrivilege	2732	taskkill.exe
Token: SeDebugPrivilege	6024	taskkill.exe
Token: SeDebugPrivilege	4404	taskkill.exe
Token: SeDebugPrivilege	116	taskkill.exe
Token: SeDebugPrivilege	1696	taskkill.exe
Token: SeDebugPrivilege	3152	taskkill.exe
Token: SeDebugPrivilege	4708	taskkill.exe
Token: SeDebugPrivilege	5936	taskkill.exe
Token: SeDebugPrivilege	4680	taskkill.exe
Token: SeDebugPrivilege	4544	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	6076	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	1840	taskkill.exe
Token: SeDebugPrivilege	5736	taskkill.exe
Token: SeDebugPrivilege	5928	taskkill.exe
Token: SeDebugPrivilege	1104	taskkill.exe
Token: SeDebugPrivilege	1488	taskkill.exe
Token: SeDebugPrivilege	3920	taskkill.exe
Token: SeDebugPrivilege	2276	taskkill.exe
Token: SeDebugPrivilege	180	taskkill.exe
Token: SeDebugPrivilege	1496	taskkill.exe
Token: SeDebugPrivilege	5116	taskkill.exe
Token: SeDebugPrivilege	5052	taskkill.exe
Token: SeDebugPrivilege	3064	taskkill.exe
Token: SeDebugPrivilege	5960	taskkill.exe
Token: SeDebugPrivilege	5836	taskkill.exe
Token: SeDebugPrivilege	5944	taskkill.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4684	chrome.exe
4684	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3296	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	88
PID 2212 wrote to memory of 3296	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	88
PID 2212 wrote to memory of 3296	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	88
PID 2212 wrote to memory of 32	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	91
PID 2212 wrote to memory of 32	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	91
PID 2212 wrote to memory of 32	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	91
PID 2212 wrote to memory of 3708	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	92
PID 2212 wrote to memory of 3708	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	92
PID 2212 wrote to memory of 5244	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	93
PID 2212 wrote to memory of 5244	2212	2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe	93
PID 3296 wrote to memory of 5252	3296	cmd.exe	94
PID 3296 wrote to memory of 5252	3296	cmd.exe	94
PID 3296 wrote to memory of 5252	3296	cmd.exe	94
PID 5244 wrote to memory of 2732	5244	Webruntime.exe	96
PID 5244 wrote to memory of 2732	5244	Webruntime.exe	96
PID 32 wrote to memory of 5820	32	1.exe	98
PID 32 wrote to memory of 5820	32	1.exe	98
PID 32 wrote to memory of 5820	32	1.exe	98
PID 5820 wrote to memory of 4448	5820	cmd.exe	101
PID 3296 wrote to memory of 1180	3296	cmd.exe	102
PID 5820 wrote to memory of 4448	5820	cmd.exe	101
PID 5820 wrote to memory of 4448	5820	cmd.exe	101
PID 3296 wrote to memory of 1180	3296	cmd.exe	102
PID 3296 wrote to memory of 1180	3296	cmd.exe	102
PID 2732 wrote to memory of 436	2732	cmd.exe	103
PID 2732 wrote to memory of 436	2732	cmd.exe	103
PID 5820 wrote to memory of 4504	5820	cmd.exe	104
PID 5820 wrote to memory of 4504	5820	cmd.exe	104
PID 5820 wrote to memory of 4504	5820	cmd.exe	104
PID 5820 wrote to memory of 1248	5820	cmd.exe	105
PID 5820 wrote to memory of 1248	5820	cmd.exe	105
PID 5820 wrote to memory of 1248	5820	cmd.exe	105
PID 2732 wrote to memory of 6100	2732	cmd.exe	106
PID 2732 wrote to memory of 6100	2732	cmd.exe	106
PID 3296 wrote to memory of 3628	3296	cmd.exe	107
PID 3296 wrote to memory of 3628	3296	cmd.exe	107
PID 3296 wrote to memory of 3628	3296	cmd.exe	107
PID 3296 wrote to memory of 5484	3296	cmd.exe	108
PID 3296 wrote to memory of 5484	3296	cmd.exe	108
PID 3296 wrote to memory of 5484	3296	cmd.exe	108
PID 3296 wrote to memory of 2308	3296	cmd.exe	109
PID 3296 wrote to memory of 2308	3296	cmd.exe	109
PID 3296 wrote to memory of 2308	3296	cmd.exe	109
PID 3296 wrote to memory of 4492	3296	cmd.exe	110
PID 3296 wrote to memory of 4492	3296	cmd.exe	110
PID 3296 wrote to memory of 4492	3296	cmd.exe	110
PID 32 wrote to memory of 3092	32	1.exe	111
PID 32 wrote to memory of 3092	32	1.exe	111
PID 32 wrote to memory of 3092	32	1.exe	111
PID 3092 wrote to memory of 3024	3092	cmd.exe	113
PID 3092 wrote to memory of 3024	3092	cmd.exe	113
PID 3092 wrote to memory of 3024	3092	cmd.exe	113
PID 3296 wrote to memory of 4024	3296	cmd.exe	114
PID 3296 wrote to memory of 4024	3296	cmd.exe	114
PID 3296 wrote to memory of 4024	3296	cmd.exe	114
PID 3092 wrote to memory of 5664	3092	cmd.exe	115
PID 3092 wrote to memory of 5664	3092	cmd.exe	115
PID 3092 wrote to memory of 5664	3092	cmd.exe	115
PID 3296 wrote to memory of 5760	3296	cmd.exe	116
PID 3296 wrote to memory of 5760	3296	cmd.exe	116
PID 3296 wrote to memory of 5760	3296	cmd.exe	116
PID 3296 wrote to memory of 620	3296	cmd.exe	117
PID 3296 wrote to memory of 620	3296	cmd.exe	117
PID 3296 wrote to memory of 620	3296	cmd.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3975168204-1612096350-4002976354-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	1.exe

C:\Users\Admin\AppData\Local\Temp\2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-31_029485bc2a80896f65c286885494122b_black-basta_cova_luca-stealer.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dllnet\1.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -window hidden -command ""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5760
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:976
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1044
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:6036
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1492
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3196
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4320
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4620
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4816
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4552
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2732
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6024
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3152
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4708
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2224
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:6076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5736
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1104
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3920
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2276
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:180
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3064
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5960
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:2584
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:5308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:1076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:2780
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:2576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:1252
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:1748
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:696
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:4428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:448
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:468
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:2200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:1640
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2908
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4784
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4860
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5072
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:2168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:2608
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:2560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:5348
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:3984
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:5816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:1536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:4496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:4908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3992
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:5052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3064
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3676
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3156
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5284
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:5412
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:4776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:5332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:1248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:5184
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:1968
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:5684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:628
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - Kills process with taskkill
    PID:456
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:2924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3904
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:5200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:316
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5740
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:1668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:5876
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1168
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:3664
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4792
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:2236
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:4556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:5692
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:5384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:5356
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:6116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:4848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:3908
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:1576
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:980
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - Kills process with taskkill
    PID:5328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:5432
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:4520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:5496
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:1616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:2016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:3704
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5116
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4924
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:3524
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:3424
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6084
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5532
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4552
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3396
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:1928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4384
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4264
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:6112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:6064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:3096
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:2076
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:3700
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5492
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2616
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:3112
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3844
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:4504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:2800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:3204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:5364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4828
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3088
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:1804
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4312
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:4572
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3416
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:1404
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3768
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5648
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:3972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - Kills process with taskkill
    PID:5016
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:976
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4440
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:4432
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:888
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:3280
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:644
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5272
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:5204
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4832
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5780
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:4200
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4428
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:2236
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:2456
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - Kills process with taskkill
    PID:4556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:1776
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5940
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:6040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4308
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4880
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4784
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4544
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:4216
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    - Kills process with taskkill
    PID:3908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:4536
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    - Kills process with taskkill
    PID:1836
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:5736
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    PID:4012
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:5484
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3884
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:2064
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    PID:2756
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2936
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:996
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    - Kills process with taskkill
    PID:4080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:4964
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    PID:3108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3696
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    PID:4944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    PID:6020
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:5556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM chrome.exe
    3⤵
    PID:3504
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM firefox.exe
    3⤵
    - Kills process with taskkill
    PID:3668
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM msedge.exe
    3⤵
    PID:5680
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM opera.exe
    3⤵
    PID:4488
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM operaGX.exe
    3⤵
    PID:4912
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM safari.exe
    3⤵
    PID:5392
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM iexplore.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:408
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM brave.exe
    3⤵
    - Kills process with taskkill
    PID:4916
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vivaldi.exe
    3⤵
    - Kills process with taskkill
    PID:1340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM yandex.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5008
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 5 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:3964
- C:\Users\Admin\AppData\Local\Temp\dllnet\1.exe
  "C:\Users\Admin\AppData\Local\Temp\dllnet\1.exe"
  2⤵
  - Executes dropped EXE
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:32
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show profile | findstr All
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show profile
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Wi-Fi Discovery
      PID:4504
  - - C:\Windows\SysWOW64\findstr.exe
      findstr All
      4⤵
      PID:1248
- - C:\Windows\SysWOW64\cmd.exe
    "cmd.exe" /C chcp 65001 && netsh wlan show networks mode=bssid
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\SysWOW64\chcp.com
      chcp 65001
      4⤵
      PID:3024
  - - C:\Windows\SysWOW64\netsh.exe
      netsh wlan show networks mode=bssid
      4⤵
      Event Triggered Execution: Netsh Helper DLL
      PID:5664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --window-position=-2400,-2400 --remote-debugging-port=9222 --profile-directory="Default"
    3⤵
    - Uses browser remote debugging
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:4684
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff86317dcf8,0x7ff86317dd04,0x7ff86317dd10
      4⤵
      PID:4916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1972,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2116 /prefetch:3
      4⤵
      PID:3568
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2088,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:1132
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2440,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2500 /prefetch:8
      4⤵
      PID:5172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3268,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3296 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1772,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4528,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4560 /prefetch:2
      4⤵
      Uses browser remote debugging
      PID:780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4792,i,8284376420749285316,5882261081670013743,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3252 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1596
- C:\Users\Admin\AppData\Local\Temp\dllnet\2.exe
  "C:\Users\Admin\AppData\Local\Temp\dllnet\2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Users\Admin\AppData\Local\Temp\dllnet\Webruntime.exe
  "C:\Users\Admin\AppData\Local\Temp\dllnet\Webruntime.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5244
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\gAttbPxEzP.bat"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2732
  - - C:\Windows\system32\chcp.com
      chcp 65001
      4⤵
      PID:436
  - - C:\Windows\system32\w32tm.exe
      w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2
      4⤵
      PID:6100
  - - C:\Users\Default User\System.exe
      "C:\Users\Default User\System.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5832

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Modify Authentication Process

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Modify Authentication Process

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery