hxxps://zloemu[.]net/files/ZLOriginSetup[.]zip

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginClientService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginCrashReporter.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginClientService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginClientService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginCrashReporter.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginCrashReporter.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginClientService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	OriginCrashReporter.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Origin.exe

Checks computer location settings 2 TTPs 12 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	OriginCrashReporter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	OriginCrashReporter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	OriginCrashReporter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	OriginCrashReporter.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Control Panel\International\Geo\Nation	Origin.exe

Loads dropped DLL 64 IoCs

pid	Process
1568	setup.exe
1504	setup.tmp
1504	setup.tmp
1504	setup.tmp
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
1536	OriginClientService.exe
2936	ZClient.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of SetThreadContext 5 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 2992	2936	ZClient.exe	124
PID 2644 set thread context of 3244	2644	ZClient.exe	151
PID 2644 set thread context of 324	2644	ZClient.exe	166
PID 2644 set thread context of 2232	2644	ZClient.exe	180
PID 2644 set thread context of 476	2644	ZClient.exe	181

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\ZLOrigin\x64\avutil-ttv-51.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\sounds\is-TM9VH.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-FDA3F.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-BA5BJ.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-2C8D4.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-5I8LL.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\imageformats\is-6NTIE.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\sounds\is-99FSE.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-NMCGU.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\Qt5WebKit.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-M2SC7.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\imageformats\is-E3KKO.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\is-ND1C8.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-3TBI8.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\ZUpdaterx32.dll	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\twitchsdk_32_release.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\imageformats\is-9DV15.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\sounds\is-63QGF.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\sounds\is-7EOJE.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-H40A6.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\legacyPM\OriginUninstall.exe	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\Origin.exe	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\x64\is-F8KMA.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\x64\is-48B9I.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-S3BRI.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\imageformats\is-QVCML.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\imageformats\is-GBAO6.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\sounds\is-GDTPO.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-UDVC1.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\imageformats\qwbmp.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-8BSP7.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\is-BURK4.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\is-GD9A2.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\is-UQO3C.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-TM7QQ.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-KPHT4.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-F6944.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\x64\libmp3lame-ttv.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\printsupport\is-TUJ6A.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\imageformats\qico.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\is-7HKJ4.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-S8IKB.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\Qt5PrintSupport.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-ESLKJ.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-VT1H2.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\OriginClientService.exe	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\audio\is-508B0.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-UB75A.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\winhttp.dll	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\Qt5Sql.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-KR9UE.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\mediaservice\is-2BFGB.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\x64\is-BLFPU.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\OriginClient.dll	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\InstallerDLL.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\legacyPM\lang\is-S1FLE.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-UR9JB.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-2AO70.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\imageformats\is-GMVQ6.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\platforms\is-C0PPV.tmp	setup.tmp
File opened for modification	C:\Program Files (x86)\ZLOrigin\imageformats\qtiff.dll	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\unins000.dat	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\is-CATUK.tmp	setup.tmp
File created	C:\Program Files (x86)\ZLOrigin\platforms\is-A4D98.tmp	setup.tmp

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	ZClient.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	ZClient.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = c0151e054028d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{38B98A41-9433-11ED-8582-62623DBA50AE} = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff2a02000040000000aa04000020020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "380483300"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	Origin.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\es-ES = "es-ES.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	ZClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_FolderType = "{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}"	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command\ = "\"C:\\PROGRA~2\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command\ = "\"C:\\Program Files (x86)\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\ = "URL:ORIGIN Protocol"	OriginClientService.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_Classes\Local Settings	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff	ZClient.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewID = "{82BA0782-5B7A-4569-B5D7-EC83085F08CC}"	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\ = "URL:EADM Protocol"	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command\ = "\"C:\\Program Files (x86)\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\FFlags = "1092616257"	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	ZClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo	ZClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\ = "URL:ORIGIN Protocol"	OriginClientService.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command\ = "\"C:\\Program Files (x86)\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command\ = "\"C:\\Program Files (x86)\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open	OriginClientService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo	ZClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo\DefaultIcon	ZClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell\open\command\ = "\"C:\\Program Files (x86)\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo\ = "URL:zlo protocol"	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command\ = "\"C:\\PROGRA~2\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell	OriginClientService.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Mode = "4"	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open\command\ = "\"C:\\PROGRA~2\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo\Shell\Open\Command\ = "\"C:\\Users\\Admin\\Downloads\\ZClient.exe\" \"%1\""	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\Sort = 000000000000000000000000000000000200000030f125b7ef471a10a5f102608c9eebac0a0000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	ZClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell	OriginClientService.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 9e0000001a00eebbfe23000010007db10d7bd29c934a973346cc89022e7c00002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020002a0000000000efbe7e47b3fbe4c93b4ba2bad3f5d3cd46f98207ba827a5b6945b5d7ec83085f08cc20002a0000000000efbe000000200000000000000000000000000000000000000000000000000100000020000000	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}\{82BA0782-5B7A-4569-B5D7-EC83085F08CC}\LogicalViewMode = "1"	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\URL Protocol	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo\URL Protocol	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders	ZClient.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\eadm\shell\open	OriginClientService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\shell	OriginClientService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\zlo\Shell\Open	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags	ZClient.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\TV_TopViewVersion = "0"	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0c00000050000000a66a63283d95d211b5d600c04fd918d00b0000007800000030f125b7ef471a10a5f102608c9eebac0e00000078000000	ZClient.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\shell\open\command\ = "\"C:\\Program Files (x86)\\ZLOrigin\\Origin.exe\" \"%1\""	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin\URL Protocol	OriginClientService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\origin2\URL Protocol	OriginClientService.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	ZClient.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\ComDlg\{FBB3477E-C9E4-4B3B-A2BA-D3F5D3CD46F9}	ZClient.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	ZClient.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 040000000100000010000000cb17e431673ee209fe455793f30afa1c0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e5190000000100000010000000d8b5fb368468620275d142ffd2aade372000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Origin.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5	Origin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 0f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c909000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c01400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af3331330b000000010000001200000056006500720069005300690067006e0000001d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e52000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Origin.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EB6D578499B1CCF5F581EAD56BE3D9B6744A5E5\Blob = 190000000100000010000000d8b5fb368468620275d142ffd2aade370300000001000000140000004eb6d578499b1ccf5f581ead56be3d9b6744a5e51d0000000100000010000000c6cbcafa17955c4cfd41eca0c654c3610b000000010000001200000056006500720069005300690067006e0000001400000001000000140000007fd365a7c2ddecbbf03009f34339fa02af33313353000000010000002500000030233021060b6086480186f8450107170630123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f0000000100000014000000e91e1e972b8f467ab4e0598fa92285387dee94c92000000001000000d7040000308204d3308203bba003020102021018dad19e267de8bb4a2158cdcc6b3b4a300d06092a864886f70d01010505003081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d204735301e170d3036313130383030303030305a170d3336303731363233353935395a3081ca310b300906035504061302555331173015060355040a130e566572695369676e2c20496e632e311f301d060355040b1316566572695369676e205472757374204e6574776f726b313a3038060355040b1331286329203230303620566572695369676e2c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79314530430603550403133c566572695369676e20436c6173732033205075626c6963205072696d6172792043657274696669636174696f6e20417574686f72697479202d20473530820122300d06092a864886f70d01010105000382010f003082010a0282010100af240808297a359e600caae74b3b4edc7cbc3c451cbb2be0fe2902f95708a364851527f5f1adc831895d22e82aaaa642b38ff8b955b7b1b74bb3fe8f7e0757ecef43db66621561cf600da4d8def8e0c362083d5413eb49ca59548526e52b8f1b9febf5a191c23349d843636a524bd28fe870514dd189697bc770f6b3dc1274db7b5d4b56d396bf1577a1b0f4a225f2af1c926718e5f40604ef90b9e400e4dd3ab519ff02baf43ceee08beb378becf4d7acf2f6f03dafdd759133191d1c40cb7424192193d914feac2a52c78fd50449e48d6347883c6983cbfe47bd2b7e4fc595ae0e9dd4d143c06773e314087ee53f9f73b8330acf5d3f3487968aee53e825150203010001a381b23081af300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106306d06082b0601050507010c0461305fa15da05b3059305730551609696d6167652f6769663021301f300706052b0e03021a04148fe5d31a86ac8d8e6bc3cf806ad448182c7b192e30251623687474703a2f2f6c6f676f2e766572697369676e2e636f6d2f76736c6f676f2e676966301d0603551d0e041604147fd365a7c2ddecbbf03009f34339fa02af333133300d06092a864886f70d0101050500038201010093244a305f62cfd81a982f3deadc992dbd77f6a5792238ecc4a7a07812ad620e457064c5e797662d98097e5fafd6cc2865f201aa081a47def9f97c925a0869200dd93e6d6e3c0d6ed8e606914018b9f8c1eddfdb41aae09620c9cd64153881c994eea284290b136f8edb0cdd2502dba48b1944d2417a05694a584f60ca7e826a0b02aa251739b5db7fe784652a958abd86de5e8116832d10ccdefda8822a6d281f0d0bc4e5e71a2619e1f4116f10b595fce7420532dbce9d515e28b69e85d35befa57d4540728eb70e6b0e06fb33354871b89d278bc4655f0d86769c447af6955cf65d320833a454b6183f685cf2424a853854835fd1e82cf2ac11d6a8ed636a	Origin.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1504	setup.tmp
1504	setup.tmp
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
1560	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
2368	chrome.exe
1736	chrome.exe
2108	chrome.exe
2888	chrome.exe
1792	chrome.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1272	chrome.exe
928	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe
3416	Origin.exe

Suspicious behavior: GetForegroundWindowSpam 9 IoCs

pid	Process
928	Origin.exe
1100	taskmgr.exe
2936	ZClient.exe
2992	Origin.exe
3244	Origin.exe
324	Origin.exe
2232	Origin.exe
476	Origin.exe
2644	ZClient.exe

Suspicious behavior: SetClipboardViewer 5 IoCs

pid	Process
1536	OriginClientService.exe
2992	Origin.exe
2056	OriginClientService.exe
3588	OriginClientService.exe
2792	OriginClientService.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

description	pid	Process
Token: SeRestorePrivilege	1064	7zG.exe
Token: 35	1064	7zG.exe
Token: SeSecurityPrivilege	1064	7zG.exe
Token: SeSecurityPrivilege	1064	7zG.exe
Token: 33	2000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2000	AUDIODG.EXE
Token: 33	2000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	928	Origin.exe
Token: SeIncBasePriorityPrivilege	928	Origin.exe
Token: SeIncBasePriorityPrivilege	1536	OriginClientService.exe
Token: SeDebugPrivilege	1100	taskmgr.exe
Token: SeDebugPrivilege	2936	ZClient.exe
Token: SeDebugPrivilege	2888	ZI.exe
Token: SeIncBasePriorityPrivilege	1796	Origin.exe
Token: SeIncBasePriorityPrivilege	1796	Origin.exe
Token: SeShutdownPrivilege	1796	Origin.exe
Token: SeIncBasePriorityPrivilege	904	OriginCrashReporter.exe
Token: SeDebugPrivilege	2992	Origin.exe
Token: SeIncBasePriorityPrivilege	2992	Origin.exe
Token: SeIncBasePriorityPrivilege	2992	Origin.exe
Token: SeIncBasePriorityPrivilege	2056	OriginClientService.exe
Token: 33	2728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2728	AUDIODG.EXE
Token: 33	2728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2728	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3416	Origin.exe
Token: SeIncBasePriorityPrivilege	3416	Origin.exe
Token: SeIncBasePriorityPrivilege	3588	OriginClientService.exe
Token: SeShutdownPrivilege	3416	Origin.exe
Token: SeDebugPrivilege	2644	ZClient.exe
Token: SeDebugPrivilege	1656	ZI.exe
Token: SeDebugPrivilege	3244	Origin.exe
Token: SeIncBasePriorityPrivilege	3244	Origin.exe
Token: SeIncBasePriorityPrivilege	3244	Origin.exe
Token: SeIncBasePriorityPrivilege	2792	OriginClientService.exe
Token: SeShutdownPrivilege	3244	Origin.exe
Token: SeIncBasePriorityPrivilege	3084	OriginCrashReporter.exe
Token: SeDebugPrivilege	324	Origin.exe
Token: SeIncBasePriorityPrivilege	324	Origin.exe
Token: SeIncBasePriorityPrivilege	324	Origin.exe
Token: SeShutdownPrivilege	324	Origin.exe
Token: SeIncBasePriorityPrivilege	3676	OriginCrashReporter.exe
Token: SeDebugPrivilege	2232	Origin.exe
Token: SeIncBasePriorityPrivilege	2232	Origin.exe
Token: SeIncBasePriorityPrivilege	2232	Origin.exe
Token: SeDebugPrivilege	476	Origin.exe
Token: SeIncBasePriorityPrivilege	476	Origin.exe
Token: SeIncBasePriorityPrivilege	476	Origin.exe
Token: SeShutdownPrivilege	476	Origin.exe
Token: SeIncBasePriorityPrivilege	764	OriginCrashReporter.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
980	iexplore.exe
980	iexplore.exe
1064	7zG.exe
1504	setup.tmp
980	iexplore.exe
928	Origin.exe
928	Origin.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
928	Origin.exe
928	Origin.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
648	chrome.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
928	Origin.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe
1100	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
980	iexplore.exe
980	iexplore.exe
1828	IEXPLORE.EXE
1828	IEXPLORE.EXE
1828	IEXPLORE.EXE
1828	IEXPLORE.EXE
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
1536	OriginClientService.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
928	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
1796	Origin.exe
904	OriginCrashReporter.exe
2936	ZClient.exe
2936	ZClient.exe
2936	ZClient.exe
2936	ZClient.exe
2992	Origin.exe
2992	Origin.exe
2056	OriginClientService.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe
2992	Origin.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 1828	980	iexplore.exe	29
PID 980 wrote to memory of 1828	980	iexplore.exe	29
PID 980 wrote to memory of 1828	980	iexplore.exe	29
PID 980 wrote to memory of 1828	980	iexplore.exe	29
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1568 wrote to memory of 1504	1568	setup.exe	36
PID 1504 wrote to memory of 928	1504	setup.tmp	38
PID 1504 wrote to memory of 928	1504	setup.tmp	38
PID 1504 wrote to memory of 928	1504	setup.tmp	38
PID 1504 wrote to memory of 928	1504	setup.tmp	38
PID 928 wrote to memory of 1536	928	Origin.exe	40
PID 928 wrote to memory of 1536	928	Origin.exe	40
PID 928 wrote to memory of 1536	928	Origin.exe	40
PID 928 wrote to memory of 1536	928	Origin.exe	40
PID 648 wrote to memory of 984	648	chrome.exe	42
PID 648 wrote to memory of 984	648	chrome.exe	42
PID 648 wrote to memory of 984	648	chrome.exe	42
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 884	648	chrome.exe	43
PID 648 wrote to memory of 1560	648	chrome.exe	44

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://zloemu.net/files/ZLOriginSetup.zip
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:980 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1828

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap8946:88:7zEvent5836
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x1f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2000

C:\Users\Admin\Downloads\ZLOrigin\setup.exe
"C:\Users\Admin\Downloads\ZLOrigin\setup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Users\Admin\AppData\Local\Temp\is-7ITHG.tmp\setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-7ITHG.tmp\setup.tmp" /SL5="$201F0,84480,0,C:\Users\Admin\Downloads\ZLOrigin\setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1504
- - C:\Program Files (x86)\ZLOrigin\Origin.exe
    "C:\Program Files (x86)\ZLOrigin\Origin.exe"
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks computer location settings
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Program Files (x86)\ZLOrigin\OriginClientService.exe
      "C:\Program Files (x86)\ZLOrigin\OriginClientService.exe" C:\Program Files (x86)\ZLOrigin\OriginClientService.exe -args:pmr1PiUhMTBVYqDgaPCyaqWC0uOqlyBW
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Loads dropped DLL
      Modifies registry class
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6994f50,0x7fef6994f60,0x7fef6994f70
  2⤵
  PID:984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1036 /prefetch:2
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1292 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1840 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2084 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3300 /prefetch:2
  2⤵
  PID:2404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=620 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4124 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=656 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2232 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:1
  2⤵
  PID:884
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  PID:188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2388 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3280 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:8
  2⤵
  PID:436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:1216
- C:\Users\Admin\Downloads\ZClient.exe
  "C:\Users\Admin\Downloads\ZClient.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2936
- - C:\Users\Admin\Downloads\ZI.exe
    ZI.exe hurr durr cli
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:2888
- - C:\PROGRA~2\ZLOrigin\Origin.exe
    C:\PROGRA~2\ZLOrigin\Origin.exe
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious behavior: SetClipboardViewer
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2992
  - - C:\PROGRA~2\ZLOrigin\OriginClientService.exe
      "C:\PROGRA~2\ZLOrigin\OriginClientService.exe" C:\PROGRA~2\ZLOrigin\OriginClientService.exe -args:pmr1PiUhMTBVYqDgaPCyantOI0inm4T3
      4⤵
      Executes dropped EXE
      Checks BIOS information in registry
      Modifies registry class
      Suspicious behavior: SetClipboardViewer
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2056
  - - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX11 -V
      4⤵
      Executes dropped EXE
      PID:1216
  - - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX12 -V
      4⤵
      Executes dropped EXE
      PID:3124
  - - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX9 -V
      4⤵
      Executes dropped EXE
      PID:3104
  - - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX11 -V
      4⤵
      Executes dropped EXE
      PID:3092
  - - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX10 -V
      4⤵
      Executes dropped EXE
      PID:300
  - - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX9 -V
      4⤵
      Executes dropped EXE
      PID:436
  - - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX12 -V
      4⤵
      Executes dropped EXE
      PID:816
  - - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX10 -V
      4⤵
      Executes dropped EXE
      PID:1736
  - - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
      "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX8 -V
      4⤵
      Executes dropped EXE
      PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3216 /prefetch:8
  2⤵
  PID:3236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 /prefetch:8
  2⤵
  PID:940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:3992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1056,5635271048343641123,9734314111896327938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3884

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
PID:1312
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1312_2023526707\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1312_2023526707\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={261a9974-c516-4097-b0b4-421cd03a6549} --system
  2⤵
  - Executes dropped EXE
  PID:1592

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1100

C:\Program Files (x86)\ZLOrigin\Origin.exe
"C:\Program Files (x86)\ZLOrigin\Origin.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1796
- C:\Program Files (x86)\ZLOrigin\OriginCrashReporter.exe
  "C:\Program Files (x86)\ZLOrigin\OriginCrashReporter.exe" C:/Users/Admin/AppData/Local/Temp/Origin.Hp1796
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:904

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x55c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728

C:\Program Files (x86)\ZLOrigin\Origin.exe
"C:\Program Files (x86)\ZLOrigin\Origin.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416
- C:\Program Files (x86)\ZLOrigin\OriginClientService.exe
  "C:\Program Files (x86)\ZLOrigin\OriginClientService.exe" C:\Program Files (x86)\ZLOrigin\OriginClientService.exe -args:pmr1PiUhMTBVYqDgaPCyaokYLKA2Yj+I
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Modifies registry class
  - Suspicious behavior: SetClipboardViewer
  - Suspicious use of AdjustPrivilegeToken
  PID:3588

C:\Users\Admin\Downloads\ZClient.exe
"C:\Users\Admin\Downloads\ZClient.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2644
- C:\Users\Admin\Downloads\ZI.exe
  ZI.exe hurr durr cli
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1656
- C:\PROGRA~2\ZLOrigin\Origin.exe
  C:\PROGRA~2\ZLOrigin\Origin.exe
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3244
- - C:\PROGRA~2\ZLOrigin\OriginClientService.exe
    "C:\PROGRA~2\ZLOrigin\OriginClientService.exe" C:\PROGRA~2\ZLOrigin\OriginClientService.exe -args:pmr1PiUhMTBVYqDgaPCyaqS+KeC4EAEL
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Modifies registry class
    - Suspicious behavior: SetClipboardViewer
    - Suspicious use of AdjustPrivilegeToken
    PID:2792
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX11 -V
    3⤵
    - Executes dropped EXE
    PID:3708
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX12 -V
    3⤵
    - Executes dropped EXE
    PID:3628
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX10 -V
    3⤵
    - Executes dropped EXE
    PID:3660
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX12 -V
    3⤵
    - Executes dropped EXE
    PID:3644
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX9 -V
    3⤵
    - Executes dropped EXE
    PID:3692
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX10 -V
    3⤵
    - Executes dropped EXE
    PID:3676
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX11 -V
    3⤵
    - Executes dropped EXE
    PID:3576
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX9 -V
    3⤵
    - Executes dropped EXE
    PID:3444
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX8 -V
    3⤵
    - Executes dropped EXE
    PID:3776
- - C:\PROGRA~2\ZLOrigin\OriginCrashReporter.exe
    C:\PROGRA~2\ZLOrigin\OriginCrashReporter.exe C:/Users/Admin/AppData/Local/Temp/Origin.Hp3244
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3084
- C:\PROGRA~2\ZLOrigin\Origin.exe
  C:\PROGRA~2\ZLOrigin\Origin.exe
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:324
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX8 -V
    3⤵
    - Executes dropped EXE
    PID:4060
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX12 -V
    3⤵
    - Executes dropped EXE
    PID:3480
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX10 -V
    3⤵
    - Executes dropped EXE
    PID:2024
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX12 -V
    3⤵
    - Executes dropped EXE
    PID:2768
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX10 -V
    3⤵
    - Executes dropped EXE
    PID:3596
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX11 -V
    3⤵
    - Executes dropped EXE
    PID:3372
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX9 -V
    3⤵
    - Executes dropped EXE
    PID:3764
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX11 -V
    3⤵
    - Executes dropped EXE
    PID:2256
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX9 -V
    3⤵
    - Executes dropped EXE
    PID:604
- - C:\PROGRA~2\ZLOrigin\OriginCrashReporter.exe
    C:\PROGRA~2\ZLOrigin\OriginCrashReporter.exe C:/Users/Admin/AppData/Local/Temp/Origin.qHp324
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3676
- C:\PROGRA~2\ZLOrigin\Origin.exe
  C:\PROGRA~2\ZLOrigin\Origin.exe
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2232
- C:\PROGRA~2\ZLOrigin\Origin.exe
  C:\PROGRA~2\ZLOrigin\Origin.exe
  2⤵
  - Executes dropped EXE
  - Checks BIOS information in registry
  - Checks computer location settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:476
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX12 -V
    3⤵
    - Executes dropped EXE
    PID:3656
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX12 -V
    3⤵
    - Executes dropped EXE
    PID:3784
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX10 -V
    3⤵
    - Executes dropped EXE
    PID:3840
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX11 -V
    3⤵
    - Executes dropped EXE
    PID:2684
- - C:\PROGRA~2\ZLOrigin\IGOProxy64.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy64.exe" -L DX9 -V
    3⤵
    - Executes dropped EXE
    PID:2000
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX11 -V
    3⤵
    - Executes dropped EXE
    PID:996
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX10 -V
    3⤵
    - Executes dropped EXE
    PID:3736
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX9 -V
    3⤵
    - Executes dropped EXE
    PID:3404
- - C:\PROGRA~2\ZLOrigin\IGOProxy.exe
    "C:\PROGRA~2\ZLOrigin\IGOProxy.exe" -L DX8 -V
    3⤵
    - Executes dropped EXE
    PID:2216
- - C:\PROGRA~2\ZLOrigin\OriginCrashReporter.exe
    C:\PROGRA~2\ZLOrigin\OriginCrashReporter.exe C:/Users/Admin/AppData/Local/Temp/Origin.qHp476
    3⤵
    - Executes dropped EXE
    - Checks BIOS information in registry
    - Checks computer location settings
    - Suspicious use of AdjustPrivilegeToken
    PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

T1130

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery