9585c5d80679c51ffea567b37abbb0436ae3103a968ee9ab2b3a5442b74055fd

Analysis

max time kernel
101s
max time network
159s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 18:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Numidia Launcher Setup 1.1.0.exe
Size 98.5MB
Sample260924-wtbs4sgf63
SHA256 9585c5d80679c51ffea567b37abbb0436ae3103a968ee9ab2b3a5442b74055fd
MD5 fd17431845bf58548ef05f168b83e1d7
SHA1 102c3f596260155f16c77f86f59c0e7ef95c637b
SHA512 497560a660958002cb498ee5a0027513772b615cce496dd14498b657aeccbd537b2d83e0763497ac04e9579c4f85ff83f6df0b82901ed0bc6bf0b77a84ce2171
SSDEEP 3145728:4iuSLi+0wOfT15GGZI7JPZKXTT3b2b4AE+digAYyQ/4D:nusi+0nT7NKJRKnbujlID
TLSH
T19D3833BE05D6250BCB924EB602267D37ED44C8472EE819E630B474787B71C85FFAE492
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery execution spyware stealer

Malware Config

Signatures

Manipulates Digital Signatures 1 TTPs 3 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.1!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_CA_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.2!7\Name = "szOID_ROOT_PROGRAM_AUTO_UPDATE_END_REVOCATION"	certutil.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.60.3.3!7\Name = "szOID_ROOT_PROGRAM_NO_OCSP_FAILOVER_TO_CRL"	certutil.exe

Executes dropped EXE 4 IoCs

pid	Process
2612	Numidia Launcher.exe
2308	Numidia Launcher.exe
3020	Numidia Launcher.exe
2856	Numidia Launcher.exe

Loads dropped DLL 18 IoCs

pid	Process
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
3020	Numidia Launcher.exe
2856	Numidia Launcher.exe
3020	Numidia Launcher.exe
3020	Numidia Launcher.exe
3020	Numidia Launcher.exe

Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Run Powershell to get system information.

execution

PowerShell

T1059.001

pid	Process
432	powershell.exe
5624	powershell.exe
5536	powershell.exe
2644	powershell.exe
5148	powershell.exe
4328	powershell.exe
5232	powershell.exe
8	powershell.exe
5292	powershell.exe
4140	powershell.exe
3404	powershell.exe
4528	powershell.exe
2396	powershell.exe

Discovers running processes 1 TTPs 64 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2940	tasklist.exe
2724	tasklist.exe
3448	tasklist.exe
4716	tasklist.exe
5756	tasklist.exe
2016	tasklist.exe
3452	tasklist.exe
4724	tasklist.exe
5328	tasklist.exe
5180	tasklist.exe
4544	tasklist.exe
5352	tasklist.exe
1444	tasklist.exe
2524	tasklist.exe
2580	tasklist.exe
3384	tasklist.exe
2548	tasklist.exe
2760	tasklist.exe
2004	tasklist.exe
792	tasklist.exe
4688	tasklist.exe
2396	tasklist.exe
3392	tasklist.exe
5180	tasklist.exe
3256	tasklist.exe
1036	tasklist.exe
3100	tasklist.exe
2404	tasklist.exe
1248	tasklist.exe
5464	tasklist.exe
1548	tasklist.exe
4568	tasklist.exe
5152	tasklist.exe
5840	tasklist.exe
5720	tasklist.exe
5312	tasklist.exe
2468	tasklist.exe
1064	tasklist.exe
4504	tasklist.exe
4108	tasklist.exe
2908	tasklist.exe
4644	tasklist.exe
916	tasklist.exe
3408	tasklist.exe
5900	tasklist.exe
5552	tasklist.exe
2888	tasklist.exe
5452	tasklist.exe
948	tasklist.exe
3088	tasklist.exe
1856	tasklist.exe
1212	tasklist.exe
5472	tasklist.exe
5988	tasklist.exe
2564	tasklist.exe
5988	tasklist.exe
4476	tasklist.exe
6068	tasklist.exe
5184	tasklist.exe
4288	tasklist.exe
4252	tasklist.exe
6012	tasklist.exe
4692	tasklist.exe
4588	tasklist.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\scoped_dir2612_582579326\image.ico	Numidia Launcher.exe
File created	C:\Windows\SystemTemp\scoped_dir2612_1695054339\image.ico	Numidia Launcher.exe
File created	C:\Windows\SystemTemp\scoped_dir2612_1300283601\image.ico	Numidia Launcher.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
2516	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Numidia Launcher Setup 1.1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Numidia Launcher.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Numidia Launcher.exe

Suspicious behavior: EnumeratesProcesses 54 IoCs

pid	Process
2516	powershell.exe
2516	powershell.exe
5624	powershell.exe
5624	powershell.exe
2968	Numidia Launcher Setup 1.1.0.exe
2968	Numidia Launcher Setup 1.1.0.exe
432	powershell.exe
432	powershell.exe
6012	tasklist.exe
6012	tasklist.exe
5536	powershell.exe
5536	powershell.exe
5536	powershell.exe
5720	tasklist.exe
5720	tasklist.exe
5352	tasklist.exe
5352	tasklist.exe
8	powershell.exe
8	powershell.exe
8	powershell.exe
1716	tasklist.exe
1716	tasklist.exe
4320	tasklist.exe
4320	tasklist.exe
5292	powershell.exe
5292	powershell.exe
5292	powershell.exe
1748	tasklist.exe
1748	tasklist.exe
1388	tasklist.exe
1388	tasklist.exe
2644	powershell.exe
2644	powershell.exe
2644	powershell.exe
4108	tasklist.exe
4108	tasklist.exe
2580	tasklist.exe
2580	tasklist.exe
6068	tasklist.exe
6068	tasklist.exe
4140	powershell.exe
4140	powershell.exe
4140	powershell.exe
1856	tasklist.exe
1856	tasklist.exe
2548	tasklist.exe
2548	tasklist.exe
5148	powershell.exe
5148	powershell.exe
5148	powershell.exe
2396	tasklist.exe
2396	tasklist.exe
5184	tasklist.exe
5184	tasklist.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2516	powershell.exe
Token: SeDebugPrivilege	5624	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeIncreaseQuotaPrivilege	432	powershell.exe
Token: SeSecurityPrivilege	432	powershell.exe
Token: SeTakeOwnershipPrivilege	432	powershell.exe
Token: SeLoadDriverPrivilege	432	powershell.exe
Token: SeSystemProfilePrivilege	432	powershell.exe
Token: SeSystemtimePrivilege	432	powershell.exe
Token: SeProfSingleProcessPrivilege	432	powershell.exe
Token: SeIncBasePriorityPrivilege	432	powershell.exe
Token: SeCreatePagefilePrivilege	432	powershell.exe
Token: SeBackupPrivilege	432	powershell.exe
Token: SeRestorePrivilege	432	powershell.exe
Token: SeShutdownPrivilege	432	powershell.exe
Token: SeDebugPrivilege	432	powershell.exe
Token: SeSystemEnvironmentPrivilege	432	powershell.exe
Token: SeRemoteShutdownPrivilege	432	powershell.exe
Token: SeUndockPrivilege	432	powershell.exe
Token: SeManageVolumePrivilege	432	powershell.exe
Token: 33	432	powershell.exe
Token: 34	432	powershell.exe
Token: 35	432	powershell.exe
Token: 36	432	powershell.exe
Token: SeSecurityPrivilege	2968	Numidia Launcher Setup 1.1.0.exe
Token: SeShutdownPrivilege	2612	Numidia Launcher.exe
Token: SeCreatePagefilePrivilege	2612	Numidia Launcher.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeShutdownPrivilege	2612	Numidia Launcher.exe
Token: SeCreatePagefilePrivilege	2612	Numidia Launcher.exe
Token: SeDebugPrivilege	6012	tasklist.exe
Token: SeDebugPrivilege	5552	tasklist.exe
Token: SeDebugPrivilege	5536	powershell.exe
Token: SeShutdownPrivilege	2612	Numidia Launcher.exe
Token: SeCreatePagefilePrivilege	2612	Numidia Launcher.exe
Token: SeIncreaseQuotaPrivilege	5536	powershell.exe
Token: SeSecurityPrivilege	5536	powershell.exe
Token: SeTakeOwnershipPrivilege	5536	powershell.exe
Token: SeLoadDriverPrivilege	5536	powershell.exe
Token: SeSystemProfilePrivilege	5536	powershell.exe
Token: SeSystemtimePrivilege	5536	powershell.exe
Token: SeProfSingleProcessPrivilege	5536	powershell.exe
Token: SeIncBasePriorityPrivilege	5536	powershell.exe
Token: SeCreatePagefilePrivilege	5536	powershell.exe
Token: SeBackupPrivilege	5536	powershell.exe
Token: SeRestorePrivilege	5536	powershell.exe
Token: SeShutdownPrivilege	5536	powershell.exe
Token: SeDebugPrivilege	5536	powershell.exe
Token: SeSystemEnvironmentPrivilege	5536	powershell.exe
Token: SeRemoteShutdownPrivilege	5536	powershell.exe
Token: SeUndockPrivilege	5536	powershell.exe
Token: SeManageVolumePrivilege	5536	powershell.exe
Token: 33	5536	powershell.exe
Token: 34	5536	powershell.exe
Token: 35	5536	powershell.exe
Token: 36	5536	powershell.exe
Token: SeShutdownPrivilege	2612	Numidia Launcher.exe
Token: SeCreatePagefilePrivilege	2612	Numidia Launcher.exe
Token: SeDebugPrivilege	1076	tasklist.exe
Token: SeShutdownPrivilege	2612	Numidia Launcher.exe
Token: SeCreatePagefilePrivilege	2612	Numidia Launcher.exe
Token: SeDebugPrivilege	4620	tasklist.exe
Token: SeShutdownPrivilege	2612	Numidia Launcher.exe
Token: SeCreatePagefilePrivilege	2612	Numidia Launcher.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2516	2968	Numidia Launcher Setup 1.1.0.exe	88
PID 2968 wrote to memory of 5624	2968	Numidia Launcher Setup 1.1.0.exe	90
PID 2968 wrote to memory of 432	2968	Numidia Launcher Setup 1.1.0.exe	92
PID 2968 wrote to memory of 1384	2968	Numidia Launcher Setup 1.1.0.exe	120
PID 2612 wrote to memory of 3020	2612	Numidia Launcher.exe	100
PID 2612 wrote to memory of 2308	2612	Numidia Launcher.exe	101
PID 2612 wrote to memory of 2856	2612	Numidia Launcher.exe	102
PID 2612 wrote to memory of 2016	2612	Numidia Launcher.exe	103
PID 2612 wrote to memory of 6012	2612	Numidia Launcher.exe	105
PID 2612 wrote to memory of 5552	2612	Numidia Launcher.exe	106
PID 2612 wrote to memory of 5536	2612	Numidia Launcher.exe	107
PID 2612 wrote to memory of 1076	2612	Numidia Launcher.exe	158
PID 2612 wrote to memory of 4620	2612	Numidia Launcher.exe	113
PID 2612 wrote to memory of 5972	2612	Numidia Launcher.exe	115
PID 2612 wrote to memory of 5720	2612	Numidia Launcher.exe	117
PID 2612 wrote to memory of 1124	2612	Numidia Launcher.exe	119
PID 2612 wrote to memory of 1752	2612	Numidia Launcher.exe	121
PID 2612 wrote to memory of 792	2612	Numidia Launcher.exe	123
PID 2612 wrote to memory of 3452	2612	Numidia Launcher.exe	125
PID 2612 wrote to memory of 5352	2612	Numidia Launcher.exe	127
PID 2612 wrote to memory of 1444	2612	Numidia Launcher.exe	128
PID 2612 wrote to memory of 8	2612	Numidia Launcher.exe	129
PID 2612 wrote to memory of 5344	2612	Numidia Launcher.exe	133
PID 2612 wrote to memory of 1800	2612	Numidia Launcher.exe	135
PID 2612 wrote to memory of 1508	2612	Numidia Launcher.exe	137
PID 2612 wrote to memory of 1716	2612	Numidia Launcher.exe	139
PID 2612 wrote to memory of 3448	2612	Numidia Launcher.exe	141
PID 2612 wrote to memory of 1352	2612	Numidia Launcher.exe	143
PID 2612 wrote to memory of 2940	2612	Numidia Launcher.exe	145
PID 2612 wrote to memory of 4564	2612	Numidia Launcher.exe	147
PID 2612 wrote to memory of 4320	2612	Numidia Launcher.exe	149
PID 2612 wrote to memory of 1212	2612	Numidia Launcher.exe	150
PID 2612 wrote to memory of 3252	2612	Numidia Launcher.exe	194
PID 2612 wrote to memory of 5292	2612	Numidia Launcher.exe	155
PID 2612 wrote to memory of 4504	2612	Numidia Launcher.exe	157
PID 2612 wrote to memory of 916	2612	Numidia Launcher.exe	159
PID 2612 wrote to memory of 2888	2612	Numidia Launcher.exe	161
PID 2612 wrote to memory of 1748	2612	Numidia Launcher.exe	163
PID 2612 wrote to memory of 2196	2612	Numidia Launcher.exe	165
PID 2612 wrote to memory of 1712	2612	Numidia Launcher.exe	167
PID 2612 wrote to memory of 2404	2612	Numidia Launcher.exe	169
PID 2612 wrote to memory of 876	2612	Numidia Launcher.exe	171
PID 2612 wrote to memory of 1388	2612	Numidia Launcher.exe	173
PID 2612 wrote to memory of 4688	2612	Numidia Launcher.exe	174
PID 2612 wrote to memory of 2524	2612	Numidia Launcher.exe	177
PID 2612 wrote to memory of 5988	2612	Numidia Launcher.exe	229
PID 2612 wrote to memory of 3912	2612	Numidia Launcher.exe	181
PID 2612 wrote to memory of 2644	2612	Numidia Launcher.exe	182
PID 2612 wrote to memory of 2468	2612	Numidia Launcher.exe	185
PID 2612 wrote to memory of 4108	2612	Numidia Launcher.exe	187
PID 2612 wrote to memory of 5948	2612	Numidia Launcher.exe	189
PID 2612 wrote to memory of 4716	2612	Numidia Launcher.exe	191
PID 2612 wrote to memory of 4900	2612	Numidia Launcher.exe	193
PID 2612 wrote to memory of 5452	2612	Numidia Launcher.exe	248
PID 2612 wrote to memory of 2580	2612	Numidia Launcher.exe	197
PID 2612 wrote to memory of 5852	2612	Numidia Launcher.exe	252
PID 2612 wrote to memory of 4476	2612	Numidia Launcher.exe	201
PID 2612 wrote to memory of 2908	2612	Numidia Launcher.exe	203
PID 2612 wrote to memory of 948	2612	Numidia Launcher.exe	205
PID 2612 wrote to memory of 5432	2612	Numidia Launcher.exe	268
PID 2612 wrote to memory of 6068	2612	Numidia Launcher.exe	272
PID 2612 wrote to memory of 4140	2612	Numidia Launcher.exe	210
PID 2612 wrote to memory of 1140	2612	Numidia Launcher.exe	330
PID 2612 wrote to memory of 4724	2612	Numidia Launcher.exe	215

C:\Users\Admin\AppData\Local\Temp\Numidia Launcher Setup 1.1.0.exe
"C:\Users\Admin\AppData\Local\Temp\Numidia Launcher Setup 1.1.0.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if (Get-Command Get-CimInstance -ErrorAction SilentlyContinue) { exit 0 } else { exit 1 }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2516
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-ExecutionPolicy -Scope Process) -eq 'Restricted') { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5624
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -C "if ((Get-CimInstance -ClassName Win32_Process | ? {$_.Path -and $_.Path.StartsWith('C:\Users\Admin\AppData\Local\Programs\Numidia Launcher', 'CurrentCultureIgnoreCase')}).Count -gt 0) { exit 0 } else { exit 1 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:432
- C:\Windows\SysWOW64\certutil.exe
  certutil -addstore Root "C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\resources\numidia_root_ca.cer"
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:1384

C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe
"C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Numidia Launcher" --gpu-preferences=WAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAQAAAAAAAAAADAAAAAAAAADgAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAKAAAAAAAAAAoAAAAAAAAAAgAAAAAAAAAEAAAAAIAAAABAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --field-trial-handle=2028,i,1261693716800811129,4866519436440245108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2032,i,12411136878532629120,9823932431457271467,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3020
- C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Numidia Launcher" --field-trial-handle=2028,i,1261693716800811129,4866519436440245108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2032,i,12411136878532629120,9823932431457271467,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - Executes dropped EXE
  PID:2308
- C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe
  "C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\Numidia Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Numidia Launcher" --app-path="C:\Users\Admin\AppData\Local\Programs\Numidia Launcher\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --launch-time-ticks=641594301 --field-trial-handle=2028,i,1261693716800811129,4866519436440245108,262144 --enable-features=PdfUseShowSaveFilePicker --disable-features=DropInputEventsWhilePaintHolding,LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --pseudonymization-salt-handle=2032,i,12411136878532629120,9823932431457271467,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2564 /prefetch:1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2856
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2016
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:6012
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5536
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1076
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4620
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5972
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1384
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:1752
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:792
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3452
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:5352
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:1444
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5344
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:1800
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1508
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:3448
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:1352
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2940
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4564
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4320
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:1212
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:3252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5292
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4504
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1076
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:916
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2888
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:2196
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:1712
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2404
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:876
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:4688
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2524
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5988
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:3912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2644
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:2468
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5948
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:4716
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4900
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3252
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5452
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:2580
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:5852
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4476
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2908
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:948
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5432
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:6068
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4140
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1140
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:4724
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5448
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3384
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:4496
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5472
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4404
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:5988
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:3244
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:2548
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5328
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:1160
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5148
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2724
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4588
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:5876
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5452
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4644
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:3000
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5852
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:5684
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5012
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1548
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:4980
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5340
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  PID:1124
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5432
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3404
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:2812
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:1248
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6068
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4708
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:4568
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2760
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5464
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5180
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:4544
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5816
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1156
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  PID:3044
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:4932
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3392
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4328
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:2172
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5152
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4288
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:5312
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3000
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:6004
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4204
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:5576
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4624
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  PID:4604
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1196
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:3408
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4692
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2564
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:4252
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4528
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1140
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5180
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:3244
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:4576
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3448
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5328
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2468
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4100
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:5900
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:2004
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  PID:4788
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2548
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:2596
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:4108
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4580
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  PID:2844
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:2396
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4864
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:5216
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4644
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:5840
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:5756
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1192
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3256
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:1200
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  - Discovers running processes
  PID:1036
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:2224
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3100
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:1064
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:4916
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:4480
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -NonInteractive -Command "Get-CimInstance Win32_Process | Select-Object -ExpandProperty Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5232
- C:\Windows\system32\tasklist.exe
  tasklist /m /fo CSV /nh
  2⤵
  PID:1708
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  PID:5760
- C:\Windows\system32\tasklist.exe
  tasklist /V /FO CSV /NH
  2⤵
  PID:1176
- C:\Windows\system32\tasklist.exe
  tasklist /FO CSV /NH
  2⤵
  - Discovers running processes
  PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact