emotet | 4d6ef2e81523b9f530939efd7a38a55ac6f01fc53699fd7c14e61cf1ce28749d

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	NDP48-DevPack-ENU.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{5d6d678e-102a-469e-9c8f-6161a7de2666} = "\"C:\\ProgramData\\Package Cache\\{5d6d678e-102a-469e-9c8f-6161a7de2666}\\NDP48-DevPack-ENU.exe\" /burn.runonce"	NDP48-DevPack-ENU.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ndp48-devpack-enu.exe

Detected potential entity reuse from brand microsoft.
phishing microsoft

Drops file in System32 directory 15 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\syswow64\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\en-us\dfshim.dll.mui	Setup.exe
File opened for modification	\??\c:\windows\syswow64\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\aspnet_counters.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\ucrtbase_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp120_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcp140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\msvcr100_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\system32\vcruntime140_clr0400.dll	Setup.exe
File opened for modification	\??\c:\windows\syswow64\ucrtbase_clr0400.dll	Setup.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_client.xml	Setup.exe
File opened for modification	\??\c:\program files (x86)\microsoft.net\redistlist\assemblylist_4_extended.xml	Setup.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\diasymreader.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\legacy.web_mediumtrust.config.default	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\installpersonalization.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\dfsvc.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\presentationframework.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.xaml\v4.0_4.0.0.0__b77a5c561934e089\system.xaml.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\presentationframework.classic.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.diagnostics.debug.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\wizard\wizardadduser.ascx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\app_data\groupedproviders.xml	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\uiautomationclientsideproviders.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.xml.linq\v4.0_4.0.0.0__b77a5c561934e089\system.xml.linq.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\xsdbuildtask\v4.0_4.0.0.0__31bf3856ad364e35\xsdbuildtask.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.data.services.design.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\wpf\system.speech.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\branding_full2.gif	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\providers\chooseprovidermanagement.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\web_mediumtrust.config.default	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\culture.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\security\wizard\app_localresources\wizardauthentication.ascx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.servicemodel.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\uiautomationprovider\v4.0_4.0.0.0__31bf3856ad364e35\uiautomationprovider.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.io.filesystem.driveinfo.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.runtime.handles.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\installpersistsqlstate.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.runtime.windowsruntime.ui.xaml.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\legacy.web_minimaltrust.config.default	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.core.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\perfcounter.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.componentmodel.dataannotations\v4.0_4.0.0.0__31bf3856ad364e35\system.componentmodel.dataannotations.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\images\requiredbang.gif	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.workflowservices\v4.0_4.0.0.0__31bf3856ad364e35\system.workflowservices.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.collections.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.servicemodel.channels\v4.0_4.0.0.0__31bf3856ad364e35\system.servicemodel.channels.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.transactions.bridge.dtc.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.jscript.tlb	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\asp.netwebadminfiles\webadminhelp_application.aspx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.data.common\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.data.common.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.directoryservices.accountmanagement.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\microsoft.common.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.web.services.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\wpf\globalmonospace.compositefont	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\security\users\app_localresources\edituser.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\web_minimaltrust.config.default	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\installwebeventsqlprovider.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\addinprocess.exe.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\installpersonalization.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\mscorsvc.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.web.extensions.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\vbc.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.threading.tasks\v4.0_4.0.0.0__b03f5f7f11d50a3a\system.threading.tasks.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\microsoft.winfx.targets	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_64\system.printing\v4.0_4.0.0.0__31bf3856ad364e35\system.printing.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\installcommon.sql	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\asp.netwebadminfiles\appconfig\app_localresources\smtpsettings.aspx.resx	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\assembly\gac_msil\system.data.services.design\v4.0_4.0.0.0__b77a5c561934e089\system.data.services.design.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\system.servicemodel.web.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\aspnet_regbrowsers.exe	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\culture.dll	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\config\web_mediumtrust.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework\v4.0.30319\workflowservicehostperformancecounters.man	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\normnfkc.nlp	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\config\legacy.web_minimaltrust.config	Setup.exe
File opened for modification	\??\c:\windows\microsoft.net\framework64\v4.0.30319\system.console.dll	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\AppExtension\com.microsoft.edge.extension\S-1-5-21-1937337463-1541593363-3360944660-1000\{0E4D1695-953B-4C41-9FA3-4C8634DF63F3}\Count = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 4b77c855403cd801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy\ClearBrowsingHistoryOnStart = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "132"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "132"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 313e185c403cd801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 026f465b403cd801	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "84"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\AppExtension\com.microsoft.edge.extension\S-1-5-21-1937337463-1541593363-3360944660-1000\{0E4D1695-953B-4C41-9FA3-4C8634DF63F3}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7f690e5f403cd801	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 6d552de8bf28d801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 414b1e56403cd801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1937337463-1541593363-3360944660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total\ = "0"	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\3B1EFD3A66EA28B16697394703A72CA340A05BD5\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000040000000100000010000000a266bb7dcc38a562631361bbf61dd11b140000000100000014000000d5f656cb8fe8a25c6268d13d94905bd7ce9a18c40300000001000000140000003b1efd3a66ea28b16697394703a72ca340a05bd50b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790020003200300031003000000069000000010000000e000000300c060a2b0601040182373c03020f000000010000002000000008fba831c08544208f5208686b991ca1b2cfc510e7301784ddf1eb5bf03932391900000001000000100000003c70faea25600ce3b2cc5f0b222ed6295c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a003020102021028cc3a25bfba44ac449a9b586b4339aa300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303130301e170d3130303632333231353732345a170d3335303632333232303430315a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313030820222300d06092a864886f70d01010105000382020f003082020a0282020100b9089e28e4e4ec064e5068b341c57bebaeb68eaf81ba22441f6534694cbe704017f2167be279fd86ed0d39f41ba8ad92901ecb3d768f5ad9b591102e3c058d8a6d2454e71fed56ad83b4509c15a51774885920fc08c58476d368d46f2878ce5cb8f3509044ffe3635fbea19a2c961504d607fe1e8421e0423111c4283694cf50a4629ec9d6ab7100b25b0ce696d40a2496f5ffc6d5b71bd7cbb72162af12dca15d37e31afb1a4698c09bc0e7631f2a0893027e1e6a8ef29f1889e42285a2b1845740fff50ed86f9cede2453101cd17e97fb08145e3aa214026a172aaa74f3c01057eee8358b15e06639962917882b70d930c246ab41bdb27ec5f95043f934a30f59718b3a7f919a793331d01c8db22525cd725c946f9a2fb875943be9b62b18d2d86441a46ac78617e3009faae89c4412a2266039139459cc78b0ca8ca0d2ffb52ea0cf76333239dfeb01fad67d6a75003c6047063b52cb1865a43b7fbaef96e296e21214126068cc9c3eeb0c28593a1b985d9e6326c4b4c3fd65da3e5b59d77c39cc055b77400e3b838ab839750e19a42241dc6c0a330d11a5ac85234f773f1c7181f33ad7aeccb4160f3239420c24845ac5c51c62e80c2e27715bd8587ed369d9691ee00b5a370ec9fe38d80688376baaf5d70522216e266fbbab3c5c2f73e2f77a6cadec1a6c6484cc3375123d327d7b84e7096f0a14476af78cf9ae166130203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414d5f656cb8fe8a25c6268d13d94905bd7ce9a18c4301006092b06010401823715010403020100300d06092a864886f70d01010b05000382020100aca5968cbfbbaea6f6d7718743315688fd1c32715b35b7d4f091f2af37e214f1f30226053e16147f14bab84ffb89b2b2e7d409cc6db95b3b64657066b7f2b15adf1a02f3f551b8676d79f3bf567be484b92b1e9b409c2634f947189869d81cd7b6d1bf8f61c267c4b5ef60438e101b3649e420caada7c1b1276509f8cdf55b2ad08433f3ef1ff2f59c0b589337a075a0de72de6c752a6622f58c0630569f40b930aa40771582d78becc0d3b2bd83c5770c1eaeaf1953a04d79719f0faf30ce67f9d62ccc22417a07f2974218ce59791055de6f10e4b8da836640160968235b972e269a02bb578cc5b8ba69623280899ea1fdc0927c7b2b3319842a63c5006862fa9f478d997a453aa7e9edee6942b5f3819b4756107bfc7036841873eaeff9974d9e3323dd260bba2ab73f44dc8327ffbd61592b11b7ca4fdbc58b0c1c31ae32f8f8b942f77fdc619a76b15a04e1113d6645b71871bec92485d6f3d4ba41345d122d25b98da613486d4bb0077d99930961817457268aab69e3e4d9c788cc24d8ec52245c1ebc9114e296deeb0ada9edd5fb35bdbd482ecc620508725403afbc7eecdfe33e56ec3840955032539c0e9355d6531a8f6bfa009cd29c7b336322edc95f383c15acf8b8df6eab321f8a4ed1e310eb64c11ab600ba412232217a3366482910412e0ab6f1ecb500561b440ff598671d1d533697ca9738a38d7640cf169	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\8F43288AD272F3103B6FB1428485EA3014C0BCFE\Blob = 5900000001000000160000005200530041002f005300480041003200350036000000190000000100000010000000bb048f1838395f6fc3a1f3d2b7e97654140000000100000014000000722d3a02319043b914054ee1eaa7c731d12389340300000001000000140000008f43288ad272f3103b6fb1428485ea3014c0bcfe69000000010000000e000000300c060a2b0601040182373c03020b00000001000000540000004d006900630072006f0073006f0066007400200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f0072006900740079002000320030003100310000000f0000000100000020000000279cd652c4e252bfbe5217ac722205d7729ba409148cfa9e6d9e5b1cb94eaff1040000000100000010000000ce0490d5e56c34a5ae0be98be581185d5c0000000100000004000000001000002000000001000000f1050000308205ed308203d5a00302010202103f8bc8b5fc9fb29643b569d66c42e144300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131303332323232303532385a170d3336303332323232313330345a308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f72697479203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100b28041aa35384d13723268224db8b2f1ffd552bc6cc7f5d24a8c36eed1c25c7e8c8aaeaf13286fc073e33aced025a85a3a6defa8b859ab132368cd0c2987d16f805c8f447f5d90015258ac51c55f2a87dcdcd80a1dc103b97bb056e8a3de6461c29ef8f37cb9ec0db554fe4cb6654f88f09c48990c420b097c315917790678288d893a4c0325be716a5c0be78460a49922e3d2af84a4a7fbd198ed0ca9de9489e10ea0dcc0ce993dea0852bb5679e41f84ba1eb8b4c4495c4f314b87dddd0567269980e07111a3b8a541e2a453b9f73229830c13bf365e04b34b43472f6be2911ed3984fdd4207c8e81d12fc99a96b3e927ec8d6693afc64bdb6099dcafd0c0ba29b77604b0394a4306912d6422dc1414ccadcaafd8f5b83469ad9fcb1d1e3b3c97f487acd24f0418f5c74d0acb010200649b7c72d21c857e3d086f30368fbd0ce71c189994a64016cfdec3091cf413c92c7e5ba861d6184c75f833962aeb4922f47f30bf855eba01f59d0bb749b1ed076e6f2e906d710e8fa64de69c635968802f046b83f27996fcb71892935f7481602358fd5797c4d02cf5feb8a834f457188f9a90d4e72e9c29c07cf491b4e040e63518c5ed800c1552cb6c6e0c2654ec93439f59cb3c47ee8616e135f15c45fd97eed1dceee44eccb2e86b1ec38f670edab5c13c1d90f0dc780b255ed34f7ac9be4c3dae7473ca6b58f31dfc54bafebf10203010001a351304f300b0603551d0f040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414722d3a02319043b914054ee1eaa7c731d1238934301006092b06010401823715010403020100300d06092a864886f70d01010b050003820201007f72cf0fb7c515db9bc049ca265bfe9e13e6d3f0d2db975ff24b3f4db3ae19aeedd797a0acefa93aa3c241b0e5b8919e13812403e609fd3f574039212456d1102f4b40a936864bb453579afbf17e898f11fe186c51aae8ed0995b5e571c9a1e98775a6157fc97e37545e7493c5c367cc0d4f6ba8170c6d08927e8bdd81aa2d7021c33d0614bbbf245ea784d73f0f2122bd4b0006db971cd85ed4c50b5c876e50a4e8c338a4fbcb2cc592669b855ecb7a6c937c8029585b57b54069ba0879a66462159d879645b5662320038b1c73a0d3a27933e0505986db2fe50225ea732a9f0014c836c7923be94e00ecd85609b9334912d2540b01abac47b691297d4cb475805201e8ca82f69fccac9c8f17ea2f26b0ab72ac0bfe9e511ec74355674f51b357d6b6ecee52b73ae94ee1d78188bc4f8e75bb4ba8f035aa26d4676749b2704c3b93dc1ddf78908672b238a4d1dc924dc958eb2b125cd43bae8c6bb083e5013ff80932f693353422afdd370d7709802bcd4800f18c9919470501e9d1bfd14ed0e628433799a40a4a08d99a7173d2aacd31136376a1376f92381e7d123c6632e7cb6de1fc5289ddcad666059a9661bea228c71ca3a736503c3aa4df4a6ee6873bceebf0e081379d133c528ebdb91d34c61dd50a6a3d9829708c892ad1ab8210481fdcf4efa5c5bb551a3863844eb76cad9554ec6522104917b8c01ec70fac5447	Setup.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3508	regsvr32.exe
3508	regsvr32.exe
3668	chrome.exe
3668	chrome.exe
3560	chrome.exe
3560	chrome.exe
3832	chrome.exe
3832	chrome.exe
1216	chrome.exe
1216	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
3332	chrome.exe
3332	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
3880	chrome.exe
3880	chrome.exe
8	taskmgr.exe
3784	chrome.exe
3784	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
8	taskmgr.exe

Suspicious behavior: MapViewOfSection 4 IoCs

pid	Process
3152	MicrosoftEdgeCP.exe
3152	MicrosoftEdgeCP.exe
3152	MicrosoftEdgeCP.exe
3152	MicrosoftEdgeCP.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	taskmgr.exe
Token: SeSystemProfilePrivilege	8	taskmgr.exe
Token: SeCreateGlobalPrivilege	8	taskmgr.exe
Token: SeDebugPrivilege	3984	MicrosoftEdge.exe
Token: SeDebugPrivilege	3984	MicrosoftEdge.exe
Token: SeDebugPrivilege	3984	MicrosoftEdge.exe
Token: SeDebugPrivilege	3984	MicrosoftEdge.exe
Token: SeDebugPrivilege	3004	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3004	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3004	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3004	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4192	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4324	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	3984	MicrosoftEdge.exe
Token: 33	4596	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4596	software_reporter_tool.exe
Token: 33	4712	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4712	software_reporter_tool.exe
Token: 33	4860	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4860	software_reporter_tool.exe
Token: 33	4756	software_reporter_tool.exe
Token: SeIncBasePriorityPrivilege	4756	software_reporter_tool.exe
Token: SeBackupPrivilege	2152	vssvc.exe
Token: SeRestorePrivilege	2152	vssvc.exe
Token: SeAuditPrivilege	2152	vssvc.exe
Token: SeDebugPrivilege	3168	Setup.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
3560	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
3560	chrome.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe
8	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3984	MicrosoftEdge.exe
3152	MicrosoftEdgeCP.exe
3152	MicrosoftEdgeCP.exe
4324	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3508	3496	regsvr32.exe	42
PID 3496 wrote to memory of 3508	3496	regsvr32.exe	42
PID 3496 wrote to memory of 3508	3496	regsvr32.exe	42
PID 3560 wrote to memory of 988	3560	chrome.exe	46
PID 3560 wrote to memory of 988	3560	chrome.exe	46
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3616	3560	chrome.exe	48
PID 3560 wrote to memory of 3668	3560	chrome.exe	47
PID 3560 wrote to memory of 3668	3560	chrome.exe	47
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49
PID 3560 wrote to memory of 2884	3560	chrome.exe	49

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\4d6ef2e81523b9f530939efd7a38a55ac6f01fc53699fd7c14e61cf1ce28749d.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\4d6ef2e81523b9f530939efd7a38a55ac6f01fc53699fd7c14e61cf1ce28749d.dll
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3508

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa550a4f50,0x7ffa550a4f60,0x7ffa550a4f70
  2⤵
  PID:988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1516 /prefetch:2
  2⤵
  PID:3616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2688 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
  2⤵
  PID:220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4624 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4704 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4624 /prefetch:2
  2⤵
  PID:540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 /prefetch:8
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=936 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1448 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4520
- C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe
  "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\SwReporter\99.279.200\software_reporter_tool.exe" --engine=2 --scan-locations=1,2,3,4,5,6,7,8,10 --disabled-locations=9,11 --session-id=XE87aXQ7XhA+t6ntUytjnMi5GR3t234l0aucsCSu --registry-suffix=ESET --enable-crash-reporting --srt-field-trial-group-name=NewCleanerUIExperiment
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --crash-handler "--database=c:\users\admin\appdata\local\Google\Software Reporter Tool" --url=https://clients2.google.com/cr/report --annotation=plat=Win32 --annotation=prod=ChromeFoil --annotation=ver=99.279.200 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff774b625a0,0x7ff774b625b0,0x7ff774b625c0
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4596
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_4712_STGJLFFYETMFORCG" --sandboxed-process-id=2 --init-done-notifier=704 --sandbox-mojo-pipe-token=16102083936539664979 --mojo-platform-channel-handle=680 --engine=2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4860
- - \??\c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe
    "c:\users\admin\appdata\local\google\chrome\user data\swreporter\99.279.200\software_reporter_tool.exe" --enable-crash-reporting --use-crash-handler-with-id="\\.\pipe\crashpad_4712_STGJLFFYETMFORCG" --sandboxed-process-id=3 --init-done-notifier=928 --sandbox-mojo-pipe-token=2303376797978095422 --mojo-platform-channel-handle=924
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2212 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2264 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=1324 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4160 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:4420
- C:\Users\Admin\Downloads\ndp48-devpack-enu.exe
  "C:\Users\Admin\Downloads\ndp48-devpack-enu.exe"
  2⤵
  - Executes dropped EXE
  PID:3564
- - C:\Windows\Temp\{0E19098F-CFDB-4FA3-A701-98E7EEAF9A3C}\.cr\ndp48-devpack-enu.exe
    "C:\Windows\Temp\{0E19098F-CFDB-4FA3-A701-98E7EEAF9A3C}\.cr\ndp48-devpack-enu.exe" -burn.clean.room="C:\Users\Admin\Downloads\ndp48-devpack-enu.exe" -burn.filehandle.attached=512 -burn.filehandle.self=532
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks whether UAC is enabled
    PID:3332
  - - C:\Windows\Temp\{D5877E07-339C-4BFD-9B39-97BF2C35DBB9}\.be\NDP48-DevPack-ENU.exe
      "C:\Windows\Temp\{D5877E07-339C-4BFD-9B39-97BF2C35DBB9}\.be\NDP48-DevPack-ENU.exe" -q -burn.elevated BurnPipe.{C1886014-4C30-42CB-97EE-E04F348F2862} {E803D849-1E3B-4841-84DF-AFC01156C0E9} 3332
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:3780
    - - C:\ProgramData\Package Cache\NetFxDevpack_FullRefreshISV_4.8_528216\packages\dotnetframework\NDP48-x86-x64-AllOS-ENU.exe
        
        "C:\ProgramData\Package Cache\NetFxDevpack_FullRefreshISV_4.8_528216\packages\dotnetframework\NDP48-x86-x64-AllOS-ENU.exe" /q /x86 /x64 /norestart /skipenucheck /keepaupaused /chainingpackage "Microsoft .NET Framework 4.8 Developer Pack" /log "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Framework_4.8_Developer_Pack_20220320095511_000_netfxfullrefreshisv.log.html" /pipe NetFxSection.{F446FD30-6858-4616-983B-2AD1CCAA3080}
        5⤵
        Executes dropped EXE
        
        PID:3420
      - C:\dfab9eae5d5fdd1d8f8c520c09ff11db\Setup.exe
        
        C:\dfab9eae5d5fdd1d8f8c520c09ff11db\\Setup.exe /q /x86 /x64 /norestart /skipenucheck /keepaupaused /chainingpackage "Microsoft .NET Framework 4.8 Developer Pack" /log "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_Framework_4.8_Developer_Pack_20220320095511_000_netfxfullrefreshisv.log.html" /pipe NetFxSection.{F446FD30-6858-4616-983B-2AD1CCAA3080} /x86 /x64 /redist
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Checks processor information in registry
        Modifies system certificate store
        Suspicious use of AdjustPrivilegeToken
        
        PID:3168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3380 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1484,9514130416569951886,2312952226107706718,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4288

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:8

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3532

C:\Users\Admin\Desktop\NjRat 0.7D.exe
"C:\Users\Admin\Desktop\NjRat 0.7D.exe"
1⤵
PID:3344
- C:\Windows\SysWOW64\fondue.exe
  "C:\Windows\system32\fondue.exe" /enable-feature:NetFx3 /caller-name:mscoreei.dll
  2⤵
  PID:956
- - C:\Windows\System32\FonDUE.EXE
    "C:\Windows\sysnative\FonDUE.EXE" /enable-feature:NetFx3 /caller-name:mscoreei.dll
    3⤵
    PID:2788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3984

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:3860

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3152

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3004

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k wsappx
1⤵
- Modifies registry class
PID:4280

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4324

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4420

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:4632

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:4348

C:\Windows\system32\compattelrunner.exe
C:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery