095a476adb563d97e366ef77789ce5154fd03d35b462b9a5ccef0bc14ec982d4

Resubmissions

30/09/2026, 02:19

260930-cr4assvtfx10

30/09/2026, 02:11

260930-cmkmwsvs2r8

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NokuqWindowsOptimizer Complete 8.exe
Size 2.8MB
Sample260930-cmkmwsvs2r
SHA256 095a476adb563d97e366ef77789ce5154fd03d35b462b9a5ccef0bc14ec982d4
MD5 e38db24f45c10577cb78f74ab9260731
SHA1 6072b76051022c9e8c9d92c067be2f137b035b5a
SHA512 9854a7671f10843650ef76e5ffe64b8077067ad57f2f37029d7dcafc15ed3c13f1060317299d2390366b31c43e23d874f8a6d48124b8879ebee35dd0878aec14
SSDEEP 49152:FthrtH3yU9KBX8N6LODkTYPfp/Zv3J/A/WUOK:9pHZKBX8N6iP7h/A/WUOK
TLSH
T1B6D52A43B9DB0DE9C9D667B891935335A734FD348E291E2B7A08D3395E636C0AD1EB00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to get system information as a root user.

execution

PowerShell

T1059.001

pid	Process
1912	powershell.exe
3424	powershell.exe
4932	powershell.exe
4364	powershell.exe
2320	powershell.exe
3956	powershell.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 6 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe
\??\F:\	powershell.exe

Modifies boot configuration data using bcdedit 16 IoCs

pid	Process
2516	bcdedit.exe
4656	bcdedit.exe
3780	bcdedit.exe
1668	bcdedit.exe
3700	bcdedit.exe
5004	bcdedit.exe
4588	bcdedit.exe
1932	bcdedit.exe
4540	bcdedit.exe
400	bcdedit.exe
2032	bcdedit.exe
1636	bcdedit.exe
3064	bcdedit.exe
4724	bcdedit.exe
3080	bcdedit.exe
3700	bcdedit.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	133	https://chatgpt.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a42fb756da9c001e	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 33 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1872	cmd.exe
884	cmd.exe
3444	cmd.exe
4428	cmd.exe
1912	cmd.exe
1080	cmd.exe
3552	cmd.exe
4824	cmd.exe
3708	cmd.exe
2572	cmd.exe
212	cmd.exe
1580	cmd.exe
1720	cmd.exe
2988	cmd.exe
860	cmd.exe
3612	cmd.exe
3784	cmd.exe
4200	cmd.exe
3704	cmd.exe
4784	cmd.exe
4988	cmd.exe
4516	cmd.exe
2504	cmd.exe
3768	cmd.exe
2212	cmd.exe
3272	cmd.exe
3868	cmd.exe
4172	cmd.exe
464	cmd.exe
2328	cmd.exe
2212	cmd.exe
4852	cmd.exe
2360	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	NokuqWindowsOptimizer Complete 8.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	NokuqWindowsOptimizer Complete 8.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4192	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

T1082

pid	Process
4144	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC	svchost.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3424	powershell.exe
3424	powershell.exe
4932	powershell.exe
4932	powershell.exe
1912	powershell.exe
1912	powershell.exe
4364	powershell.exe
4364	powershell.exe
2320	powershell.exe
2320	powershell.exe
3956	powershell.exe
3956	powershell.exe
744	chrome.exe
744	chrome.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4144	WMIC.exe
Token: SeSecurityPrivilege	4144	WMIC.exe
Token: SeTakeOwnershipPrivilege	4144	WMIC.exe
Token: SeLoadDriverPrivilege	4144	WMIC.exe
Token: SeSystemProfilePrivilege	4144	WMIC.exe
Token: SeSystemtimePrivilege	4144	WMIC.exe
Token: SeProfSingleProcessPrivilege	4144	WMIC.exe
Token: SeIncBasePriorityPrivilege	4144	WMIC.exe
Token: SeCreatePagefilePrivilege	4144	WMIC.exe
Token: SeBackupPrivilege	4144	WMIC.exe
Token: SeRestorePrivilege	4144	WMIC.exe
Token: SeShutdownPrivilege	4144	WMIC.exe
Token: SeDebugPrivilege	4144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4144	WMIC.exe
Token: SeRemoteShutdownPrivilege	4144	WMIC.exe
Token: SeUndockPrivilege	4144	WMIC.exe
Token: SeManageVolumePrivilege	4144	WMIC.exe
Token: 33	4144	WMIC.exe
Token: 34	4144	WMIC.exe
Token: 35	4144	WMIC.exe
Token: 36	4144	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4144	WMIC.exe
Token: SeSecurityPrivilege	4144	WMIC.exe
Token: SeTakeOwnershipPrivilege	4144	WMIC.exe
Token: SeLoadDriverPrivilege	4144	WMIC.exe
Token: SeSystemProfilePrivilege	4144	WMIC.exe
Token: SeSystemtimePrivilege	4144	WMIC.exe
Token: SeProfSingleProcessPrivilege	4144	WMIC.exe
Token: SeIncBasePriorityPrivilege	4144	WMIC.exe
Token: SeCreatePagefilePrivilege	4144	WMIC.exe
Token: SeBackupPrivilege	4144	WMIC.exe
Token: SeRestorePrivilege	4144	WMIC.exe
Token: SeShutdownPrivilege	4144	WMIC.exe
Token: SeDebugPrivilege	4144	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4144	WMIC.exe
Token: SeRemoteShutdownPrivilege	4144	WMIC.exe
Token: SeUndockPrivilege	4144	WMIC.exe
Token: SeManageVolumePrivilege	4144	WMIC.exe
Token: 33	4144	WMIC.exe
Token: 34	4144	WMIC.exe
Token: 35	4144	WMIC.exe
Token: 36	4144	WMIC.exe
Token: SeDebugPrivilege	3424	powershell.exe
Token: SeDebugPrivilege	4932	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeIncreaseQuotaPrivilege	1912	powershell.exe
Token: SeSecurityPrivilege	1912	powershell.exe
Token: SeTakeOwnershipPrivilege	1912	powershell.exe
Token: SeLoadDriverPrivilege	1912	powershell.exe
Token: SeSystemProfilePrivilege	1912	powershell.exe
Token: SeSystemtimePrivilege	1912	powershell.exe
Token: SeProfSingleProcessPrivilege	1912	powershell.exe
Token: SeIncBasePriorityPrivilege	1912	powershell.exe
Token: SeCreatePagefilePrivilege	1912	powershell.exe
Token: SeBackupPrivilege	1912	powershell.exe
Token: SeRestorePrivilege	1912	powershell.exe
Token: SeShutdownPrivilege	1912	powershell.exe
Token: SeDebugPrivilege	1912	powershell.exe
Token: SeSystemEnvironmentPrivilege	1912	powershell.exe
Token: SeRemoteShutdownPrivilege	1912	powershell.exe
Token: SeUndockPrivilege	1912	powershell.exe
Token: SeManageVolumePrivilege	1912	powershell.exe
Token: 33	1912	powershell.exe
Token: 34	1912	powershell.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5076	NokuqWindowsOptimizer Complete 8.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe
744	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5076	NokuqWindowsOptimizer Complete 8.exe
5076	NokuqWindowsOptimizer Complete 8.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4428	5076	NokuqWindowsOptimizer Complete 8.exe	86
PID 4428 wrote to memory of 4144	4428	cmd.exe	88
PID 5076 wrote to memory of 4988	5076	NokuqWindowsOptimizer Complete 8.exe	96
PID 5076 wrote to memory of 3768	5076	NokuqWindowsOptimizer Complete 8.exe	98
PID 3768 wrote to memory of 3424	3768	cmd.exe	100
PID 5076 wrote to memory of 4200	5076	NokuqWindowsOptimizer Complete 8.exe	102
PID 4200 wrote to memory of 4932	4200	cmd.exe	104
PID 5076 wrote to memory of 4852	5076	NokuqWindowsOptimizer Complete 8.exe	106
PID 4852 wrote to memory of 1912	4852	cmd.exe	108
PID 5076 wrote to memory of 2212	5076	NokuqWindowsOptimizer Complete 8.exe	112
PID 5076 wrote to memory of 3708	5076	NokuqWindowsOptimizer Complete 8.exe	114
PID 3708 wrote to memory of 2516	3708	cmd.exe	116
PID 5076 wrote to memory of 3704	5076	NokuqWindowsOptimizer Complete 8.exe	117
PID 5076 wrote to memory of 3272	5076	NokuqWindowsOptimizer Complete 8.exe	119
PID 5076 wrote to memory of 3612	5076	NokuqWindowsOptimizer Complete 8.exe	122
PID 3612 wrote to memory of 4364	3612	cmd.exe	124
PID 5076 wrote to memory of 4516	5076	NokuqWindowsOptimizer Complete 8.exe	125
PID 5076 wrote to memory of 3784	5076	NokuqWindowsOptimizer Complete 8.exe	128
PID 5076 wrote to memory of 2572	5076	NokuqWindowsOptimizer Complete 8.exe	133
PID 2572 wrote to memory of 4656	2572	cmd.exe	135
PID 5076 wrote to memory of 1912	5076	NokuqWindowsOptimizer Complete 8.exe	136
PID 1912 wrote to memory of 3780	1912	cmd.exe	138
PID 5076 wrote to memory of 4784	5076	NokuqWindowsOptimizer Complete 8.exe	139
PID 5076 wrote to memory of 2360	5076	NokuqWindowsOptimizer Complete 8.exe	144
PID 2360 wrote to memory of 1668	2360	cmd.exe	146
PID 5076 wrote to memory of 3868	5076	NokuqWindowsOptimizer Complete 8.exe	147
PID 3868 wrote to memory of 3700	3868	cmd.exe	149
PID 5076 wrote to memory of 4172	5076	NokuqWindowsOptimizer Complete 8.exe	150
PID 4172 wrote to memory of 5004	4172	cmd.exe	152
PID 5076 wrote to memory of 1080	5076	NokuqWindowsOptimizer Complete 8.exe	153
PID 1080 wrote to memory of 4588	1080	cmd.exe	155
PID 5076 wrote to memory of 212	5076	NokuqWindowsOptimizer Complete 8.exe	156
PID 212 wrote to memory of 1932	212	cmd.exe	158
PID 5076 wrote to memory of 464	5076	NokuqWindowsOptimizer Complete 8.exe	159
PID 464 wrote to memory of 4540	464	cmd.exe	161
PID 5076 wrote to memory of 2504	5076	NokuqWindowsOptimizer Complete 8.exe	162
PID 2504 wrote to memory of 400	2504	cmd.exe	164
PID 5076 wrote to memory of 1580	5076	NokuqWindowsOptimizer Complete 8.exe	165
PID 1580 wrote to memory of 2032	1580	cmd.exe	167
PID 5076 wrote to memory of 1872	5076	NokuqWindowsOptimizer Complete 8.exe	168
PID 1872 wrote to memory of 1636	1872	cmd.exe	170
PID 5076 wrote to memory of 1720	5076	NokuqWindowsOptimizer Complete 8.exe	171
PID 1720 wrote to memory of 3064	1720	cmd.exe	173
PID 5076 wrote to memory of 2988	5076	NokuqWindowsOptimizer Complete 8.exe	174
PID 2988 wrote to memory of 4724	2988	cmd.exe	176
PID 5076 wrote to memory of 884	5076	NokuqWindowsOptimizer Complete 8.exe	177
PID 884 wrote to memory of 3080	884	cmd.exe	179
PID 5076 wrote to memory of 3552	5076	NokuqWindowsOptimizer Complete 8.exe	180
PID 3552 wrote to memory of 744	3552	cmd.exe	182
PID 5076 wrote to memory of 3444	5076	NokuqWindowsOptimizer Complete 8.exe	183
PID 3444 wrote to memory of 3848	3444	cmd.exe	185
PID 5076 wrote to memory of 2328	5076	NokuqWindowsOptimizer Complete 8.exe	186
PID 2328 wrote to memory of 1880	2328	cmd.exe	188
PID 5076 wrote to memory of 4824	5076	NokuqWindowsOptimizer Complete 8.exe	189
PID 4824 wrote to memory of 3700	4824	cmd.exe	191
PID 5076 wrote to memory of 860	5076	NokuqWindowsOptimizer Complete 8.exe	195
PID 860 wrote to memory of 2320	860	cmd.exe	197
PID 5076 wrote to memory of 2212	5076	NokuqWindowsOptimizer Complete 8.exe	199
PID 2212 wrote to memory of 3956	2212	cmd.exe	201
PID 744 wrote to memory of 2516	744	chrome.exe	204
PID 744 wrote to memory of 4112	744	chrome.exe	205
PID 744 wrote to memory of 4112	744	chrome.exe	205
PID 744 wrote to memory of 4192	744	chrome.exe	206
PID 744 wrote to memory of 4316	744	chrome.exe	207

C:\Users\Admin\AppData\Local\Temp\NokuqWindowsOptimizer Complete 8.exe
"C:\Users\Admin\AppData\Local\Temp\NokuqWindowsOptimizer Complete 8.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c wmic path win32_VideoController get name
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic path win32_VideoController get name
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Detects videocard installed
    - Suspicious use of AdjustPrivilegeToken
    PID:4144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4988
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try{$s=Get-WmiObject -Namespace 'root\OpenHardwareMonitor' -Class Sensor -Filter \"SensorType='Temperature' AND Name LIKE '%GPU%'\" -ErrorAction Stop | Sort-Object Value -Descending | Select-Object -First 1;if($s){[int]$s.Value}else{''}}catch{''}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{$s=Get-WmiObject -Namespace 'root\OpenHardwareMonitor' -Class Sensor -Filter \"SensorType='Temperature' AND Name LIKE '%GPU%'\" -ErrorAction Stop | Sort-Object Value -Descending | Select-Object -First 1;if($s){[int]$s.Value}else{''}}catch{''}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3424
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "try{$s=Get-WmiObject -Namespace 'root\LibreHardwareMonitor' -Class Sensor -Filter \"SensorType='Temperature' AND Name LIKE '%GPU%'\" -ErrorAction Stop | Sort-Object Value -Descending | Select-Object -First 1;if($s){[int]$s.Value}else{''}}catch{''}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "try{$s=Get-WmiObject -Namespace 'root\LibreHardwareMonitor' -Class Sensor -Filter \"SensorType='Temperature' AND Name LIKE '%GPU%'\" -ErrorAction Stop | Sort-Object Value -Descending | Select-Object -First 1;if($s){[int]$s.Value}else{''}}catch{''}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "$t=(Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature;if($t){$t}else{''}"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "$t=(Get-CimInstance -Namespace root/wmi -ClassName MSAcpi_ThermalZoneTemperature -ErrorAction SilentlyContinue | Select-Object -First 1).CurrentTemperature;if($t){$t}else{''}"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1912
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:2212
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3272
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.TaskPath -eq '\\' -and $_.Settings.Enabled -eq $true -and $_.Principal.RunLevel -ne 'Highest' -and $_.Author -notlike '*Microsoft*' -and $_.Author -notlike '*Windows*'} | Select-Object TaskName,@{N='Cmd';E={$_.Actions[0].Execute}},Author,State | ForEach-Object { $_.TaskName+'`t'+$_.Cmd+'`t'+$_.Author+'`t'+$_.State } | Out-String -Width 512"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.TaskPath -eq '\\' -and $_.Settings.Enabled -eq $true -and $_.Principal.RunLevel -ne 'Highest' -and $_.Author -notlike '*Microsoft*' -and $_.Author -notlike '*Windows*'} | Select-Object TaskName,@{N='Cmd';E={$_.Actions[0].Execute}},Author,State | ForEach-Object { $_.TaskName+'`t'+$_.Cmd+'`t'+$_.Author+'`t'+$_.State } | Out-String -Width 512"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4516
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4656
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c nvidia-smi --query-gpu=temperature.gpu --format=csv,noheader,nounits 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:4784
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1668
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:5004
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1080
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4588
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1932
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:400
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1580
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1872
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1636
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1720
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3064
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2988
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4724
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3080
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c Netsh int tcp set global autotuning=disabled
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3552
- - C:\Windows\system32\netsh.exe
    Netsh int tcp set global autotuning=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:744
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c netsh int udp set global uro=enabled
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\system32\netsh.exe
    netsh int udp set global uro=enabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:3848
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "FastSendDatagramThreshold" /t REG_SZ /d "409600" /f
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Windows\system32\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFD\Parameters" /v "FastSendDatagramThreshold" /t REG_SZ /d "409600" /f
    3⤵
    PID:1880
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c bcdedit /enum {current}
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\system32\bcdedit.exe
    bcdedit /enum {current}
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3700
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.TaskPath -eq '\\' -and $_.Settings.Enabled -eq $true -and $_.Principal.RunLevel -ne 'Highest' -and $_.Author -notlike '*Microsoft*' -and $_.Author -notlike '*Windows*'} | Select-Object TaskName,@{N='Cmd';E={$_.Actions[0].Execute}},Author,State | ForEach-Object { $_.TaskName+'`t'+$_.Cmd+'`t'+$_.Author+'`t'+$_.State } | Out-String -Width 512"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.TaskPath -eq '\\' -and $_.Settings.Enabled -eq $true -and $_.Principal.RunLevel -ne 'Highest' -and $_.Author -notlike '*Microsoft*' -and $_.Author -notlike '*Windows*'} | Select-Object TaskName,@{N='Cmd';E={$_.Actions[0].Execute}},Author,State | ForEach-Object { $_.TaskName+'`t'+$_.Cmd+'`t'+$_.Author+'`t'+$_.State } | Out-String -Width 512"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:2320
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.TaskPath -eq '\\' -and $_.Settings.Enabled -eq $true -and $_.Principal.RunLevel -ne 'Highest' -and $_.Author -notlike '*Microsoft*' -and $_.Author -notlike '*Windows*'} | Select-Object TaskName,@{N='Cmd';E={$_.Actions[0].Execute}},Author,State | ForEach-Object { $_.TaskName+'`t'+$_.Cmd+'`t'+$_.Author+'`t'+$_.State } | Out-String -Width 512"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-ScheduledTask | Where-Object { $_.TaskPath -eq '\\' -and $_.Settings.Enabled -eq $true -and $_.Principal.RunLevel -ne 'Highest' -and $_.Author -notlike '*Microsoft*' -and $_.Author -notlike '*Windows*'} | Select-Object TaskName,@{N='Cmd';E={$_.Actions[0].Execute}},Author,State | ForEach-Object { $_.TaskName+'`t'+$_.Cmd+'`t'+$_.Author+'`t'+$_.State } | Out-String -Width 512"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Enumerates connected drives
    - Suspicious behavior: EnumeratesProcesses
    PID:3956

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7fff4ff8c728,0x7fff4ff8c734,0x7fff4ff8c740
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1700,i,11950213495384328478,10033242568187194001,262144 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,9595060344501153685,8531563967283263131,524288 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,17890810208881673455,7275079967100222955,524288 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2292 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3256,i,17508538250002609449,1352600775585235435,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3460,i,7181893003329964030,561852085300180975,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4500,i,7741278952285293444,10131926448460324196,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4516 /prefetch:2
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4716,i,3352765593388741054,15024789930615521436,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5560,i,6774161201058396184,3652725922273531686,524288 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5812,i,9151932679052826345,3880951351778202912,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3468,i,5447769114692278183,2083570872289412068,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3960,i,6878620573088885472,14967936670309618389,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3972,i,9316818154656917287,4728265947710299723,2097152 --field-trial-handle=1920,i,14390874558018275631,1537847813235826972,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:3296

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 148ef6d0164e7885080f0cf49430cc83ad94ade8b3920b0ce5eacab95abb40b7
MD5 af1005f36a1a4ebdd15114e4b65abb66
SHA1 bc4dc64d6aa5afe472a50c8413f1349b6764ae39
SHA512 f40967d7271a948880c8877143320dae5906f5e450e8a50fdfe69a71dd9c9c0b6e1df5d62e781d792cf439813cae6ef7933d0691b8363531b3e6b5983255a465
TLSH
T19EF028E5CD30EC3718FD1B2920684B4AE750135B2780895F3A3D961C8FB063B8A8696C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 eb8ab25e805ec413abc55c28a82b1f47f8245ad391ea5bba7dd3c0561a0ad716
MD5 4c84cd354b61d3c839c1cf1bcb420c1f
SHA1 d775fdab7b36caeaf6bf8f814d99706f5f8b4556
SHA512 97f0bf049492c324ed0913f2a210acc5004fcb970ca82a7edf7050dd42a945d0c1a8bf67b6f22d07bd55273c9262921eaa8d1a8c4fddd132f8d107ee4694889d
SSDEEP 192:hRsIcBzh1b7VmkZJVv7D0spAPRp2kwbry9+Hsb+WNnRI+7rIk2/cchTkw1VyIsnH:hRsImzhN78GlvjUXinyUwRFHz2rZD8
TLSH
T1FD42C52EED24757F5CD6C22AF9227B67D3F5102520942E48EAFC8A3C14E79DD2227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 d6ef7be1fdf322a98e133d0f16a9689d7b7e779ed80b3b246f7f0abd127671a4
MD5 f47488285ba0b5fb4fc947c0cd4d65d0
SHA1 e2e420ed69ab302b7e65f41cd50c711369a8f339
SHA512 edefbf73c6e7d3b427d1f6fbef00c51ead37774dc83bc59794179b134a29fdd70c2466f4f32c36956cac1428a67c415f0977c6e87ea2e96365244a4ec6f04337
SSDEEP 384:FE3cjxE397KxkXqKf/pUZNCgVLH2HfgslaW7pLuLceSHE31XODxE3d+ErU3jcHGz:FE3wxE397KxkXqKf/pUZNCgVLH2Hfgsn
TLSH
T18A7209677C4C9A3B0F94C9CCDC277A4FEDB9024B65D9886482FA982503D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 264KB
SHA256 7f09b8fcc49a7b1eaa9bece71d1bb4aa557ce57ddd3218869d9322959c24a46a
MD5 69f538fb8335d9bcfce78e8831219967
SHA1 e58034ddd519a4aba69444dd2df67615fb1f435a
SHA512 6db7762f49b1040c98444090d53375b445007a2927017a249b87c3ce07a4db0dbdf3962ab2353e2b2e0f5e055402f21c28bd747b44f7d536b497a0bed55d661f
SSDEEP 6144:tB4yWMAieCkVTlNe/BrOMI+hFD+7t56OD9ZfSAppr89:/PNKC4PcrqyFSXD9ZfS4+9
TLSH
T1284413327A84DCF7CEF8A255B23B774C4AA5ADD5429B870D4C466F8D9119C8C0A72F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 130KB
SHA256 3a4bb84c7de8bff011b6f09ccadbc9d830f7028ce6dc075613c0e168817bef36
MD5 e5aef2c020057f0b2be27b6a3404579e
SHA1 cb8225333d253d8d6f477d947bfcea89bca40fc8
SHA512 a55fa16c653e40a14d0da21786b003dc2572af9b5e1a66d4bbce96ee3e32e30350872a4fc08033a981c890ba4d3a01bc98df9e2097e3467a409a29133ee28ea5
SSDEEP 3072:r+lPFz63F8+7t5x0M2XLqD90xWfrz6a9pInCOp+EGFAJ8P+gy:r+hFD+7t56OD9ZfSAppry
TLSH
T12ED31232AA91D8BBC9BC6541B157A300CE766CED41EE7A09444A5F8EE09FC4C0773A33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 1022ec2fed08ff473817fc53893e192a8e33e6a16f3d2c8cb6fd37f49c938e1e
MD5 223bd4ae02766ddc32e6145fd1a29301
SHA1 900cfd6526d7e33fb4039a1cc2790ea049bc2c5b
SHA512 648cd3f8a89a18128d2b1bf960835e087a74cdbc783dbfcc712b3cb9e3a2e4f715e534ba2ef81d89af8f60d4882f6859373248c875ceb26ad0922e891f2e74cc
TLSH
T10A610E323375B1D4C9567F072E2819C053BF8396EA94AF5CB29C621ED92641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download