6cca04bcf7e42bc36ca7dd57ebbe325ee8df68673faadfced32e1f9cc9cc9327

System Information Discovery

Processes:

javaw.exejavaw.exejavaw.exejavaw.exejavaw.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	javaw.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	javaw.exe

Executes dropped EXE 12 IoCs

Processes:

SKlauncher 3.0.exejavaw.exeSKlauncher 3.0.exejavaw.exeSKlauncher 3.0.exejavaw.exeSKlauncher 3.0.exejavaw.exeSKlauncher 3.0.exejavaw.exeSKlauncher 3.0.exejavaw.exe

pid	process
888	SKlauncher 3.0.exe
1532	javaw.exe
2016	SKlauncher 3.0.exe
4348	javaw.exe
1624	SKlauncher 3.0.exe
3348	javaw.exe
4744	SKlauncher 3.0.exe
4688	javaw.exe
2324	SKlauncher 3.0.exe
1792	javaw.exe
3256	SKlauncher 3.0.exe
3024	javaw.exe

Loads dropped DLL 64 IoCs

Processes:

javaw.exejavaw.exejavaw.exejavaw.exe

pid	process
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
3348	javaw.exe
4688	javaw.exe
4688	javaw.exe
4688	javaw.exe
4688	javaw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows\CurrentVersion\Run	chrome.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Drops file in System32 directory 4 IoCs

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\windowsaccessbridge-64.dll	msiexec.exe
File opened for modification	C:\Windows\system32\windowsaccessbridge-64.dll	msiexec.exe
File created	C:\Windows\system32\windowsaccessbridge-64.dll	msiexec.exe
File created	C:\Windows\SysWOW64\windowsaccessbridge-32.dll	msiexec.exe

Drops file in Program Files directory 64 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\tzmappings	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\javafx.controls\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\dt_socket.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.internal.jvmstat\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\conf\management\jmxremote.access	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.naming.dns.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.xml\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.charsets\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.jdi.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.internal.le\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\javafx-swt.jar	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.nio.mapmode.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\java.exe	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.internal.le\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javafx_font.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\psfont.properties.ja	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\psfontj2d.properties	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.jdi\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\ktab.exe	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.prefs\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.xml.dom.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.localedata.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.zipfs.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.random\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\javafx.swing\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.desktop\freetype.md	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\jstat.exe	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\dt_shmem.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.crypto.mscapi\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.sql\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\jshell.exe	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.base\aes.md	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javajpeg.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.xml\jcup.md	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\w2k_lsa_auth.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.management\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\security\cacerts	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\ct.sym	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.dynalink\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.jlink\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\j2pkcs11.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\lcms.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\javafx.graphics.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\javafx.web\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.management.rmi\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.jstatd\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.accessibility\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.net.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.jartool.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.transaction.xa\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\include\classfile_constants.h	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.net\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\jawt.lib	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.sql\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.crypto.mscapi.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.datatransfer\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.security.sasl\LICENSE	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\jdk.security.jgss\ASSEMBLY_EXCEPTION	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\lib\classlist	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\include\win32\jni_md.h	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\jmods\jdk.jpackage.jmod	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\mlib_image.dll	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.management\ADDITIONAL_LICENSE_INFO	msiexec.exe
File created	C:\Program Files\BellSoft\LibericaJDK-19-Full\legal\java.base\wepoll.md	msiexec.exe

Drops file in Windows directory 10 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\e5c2216.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{488A854A-35F6-45AD-9C09-EDFCB18E39B8}\icon_v2.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e5c2216.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{488A854A-35F6-45AD-9C09-EDFCB18E39B8}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3669.tmp	msiexec.exe
File created	C:\Windows\Installer\e5c2219.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{488A854A-35F6-45AD-9C09-EDFCB18E39B8}\icon_v2.ico	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4852	4348	WerFault.exe	javaw.exe
4552	4688	WerFault.exe	javaw.exe
4356	1792	WerFault.exe	javaw.exe
1224	3024	WerFault.exe	javaw.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exevssvc.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000027c70fafd0cbe6b20000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000027c70faf0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3f000000ffffffff00000000070001000068090027c70faf000000000000d0120000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000027c70faf00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

javaw.exejavaw.exejavaw.exejavaw.exejavaw.exejavaw.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 575ec7859e45d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3702029538"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\Total = "2339"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\bell-sw.com	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\ = "2220"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "26"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2307"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\google.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\doubleclick.net\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "386087290"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\ = "2368"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000b502fb34fb4d6b18588faaf620f43ee6652f44db76448b0b700cc588b7acfe4e000000000e800000000200002000000015e535ff3f68d960bc77262f548ef3d2617312ef24bf867a8dfcbeec4450ea033001000067734eff64751f396fa0d05b593c70718b5cd9aa27df06fbc22e22b60e929af30e4faa59ca27cfd65b97b45e722e5ac4f65fade2ac4162aff0cd81dc5152923b282824572d10c3e9ec303789581810eb0797a48e3ef645ec5d7e99e90fdaebc824c93f3a6a0149632f60e157d03473bfa320547eb3b3bd4bc30c1f13e2a4e4e141fcc4b30ae6c8f2a383a5c70eeb7804719a2703ad83657dcd3e32169a737d6de6c8359d8a8f6f144573d063aca77dc6f0a0ee96927463735e115ffc3915ed65b57304bf3870c6887bc124cabb52a22e02fb7cffe01deb94c24c837b404a25c371bd0fa9211cd8343fbead4ec4dab95bf18ae014ebee8dee67c6f472c3c92c43f9c1778b6c63b9ea15b2ade84bcd53f1dc6e6ab680612f419aa962b5b4437d54710f5334dad9588a8c85d818dd57225240000000820a6168afe2e81aa079e4660ddfd95b333153596279a4f54b0bf7e26a87efbcf8a5b843b6ae39aa3db087a31cab18216847e507dae3246935e89630d7317bf0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2368"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\ = "2400"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DOMStorage\skmedix.pl	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000ea35084c81290eba8f3dab93282e730cf88f46693123ee501bac6063dd803d03000000000e8000000002000020000000c35e0126a58fd36002d616aee8f9e6bd4cff8ea274b7d50b24ea54b98e86dfd7200000003e34e554dd6efd4bd705f752d49327f5f72c94ee0212193722f9b727afc4dc5c40000000c86dcc351fc0652564905cb575be1330abcdcd5451f4a8f56bd245fa41d03c6366e1f05a38fb875085e9a4b5bb26a7b69c6b6b09c9a6eebffd69a7ea05efc77a	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c085d5ee375bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31021879"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\Total = "26"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\google.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3711571086"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\ = "2339"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31021879"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "2378"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d0000000002000000000010660000000100002000000009f74c0e3d066b8782359970ad50c6a9f94f83bad4c42c77a2d457f7a065e24a000000000e8000000002000020000000847da00f1d0752b25ad0af8894158c79e57d0c3557a20c2fff440f38dd182ef1c001000095d61eb1937f4c79891699deec00603076a11653d564f4b812dd33f85cb118731358d51af8bee6d3d7e458efb7bdaf9ac9635966ea10bfad90355a9cd2e3ed02458b2607c632ed529a03a9afdeae951c15e4b8013d4ea9c390b01a486907327b469125f7c960849320f5a014ca9c9e181069bf90b74472e9b4cfda0b74e3bc402480f4e4f2b4a9a9ebc3eef1a2ba1de4a908c353fb5ee3c02ac5958500a8c302834541ab169bd654e254f282233e33fb131bd316640c987946d0e0bef6739e3a5104b63609958b221d727489db401bb2c7b5162b74b879b6ca3e5aa49482d0ef6b08b6dcb7cf6df2f5942be40b0b2b886c7ccbad371b6c41ff12ff2a95692acd6961d2c0e8c946e6f1c3a2f6f1ee9b7e1d0e9adf6fa76e4467590157c05de7878a484569d556e1f2122cbed3d7f0c74e7c9f331b53f6a7a83e1da1532ec7a889da359c3c4f88e937c682c113d4a9c4203209af29432aae3a167368a82f8cbe159aa3cdf52573ed9bbac9ba3a42c62e987f0d818be1aa40d516fcafe370d55d574025db631cbd2d9b46e1fa46758659033cc3202f248b1e0e8d1a7697fd4ffef127aa0423496fb7baab1e797bef0305616c13251ca474aa48045be096fa5c33fc400000006f8c346a0013f556713500fa7f8d49ce46eedd8922adc8cdb04f621051f5933670a920e4f3cc627da389b8a03b1072896a2a061d99de4e2a494fa686502673c4	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "58"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\Total = "2378"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 305cd8d7375bd901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\Total = "58"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\bell-sw.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{D1E09AC2-C8FA-4750-BDD8-6A0E3B9107E0}"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\Total = "2307"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000a35f86c47fced2361d1788297c53777d7749ee299339a2ef0a3439adf2693193000000000e8000000002000020000000409d669d3d48abb174ffc03f65e36a07657c175c47d043aef3beef7c65b5072f200000008992ebb8b5aac6054784a71564e1baf0195cb5afa7a1725067da28d6a7b13ed040000000817c3c6cb2b3541e9d75e8fb55af2ca65169eba534fc6b8e6133f6d502383ac3acd96ea502c9401cacbbd45cace9383785c37ccc20f63a7878457a43716779f9	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\skmedix.pl\Total = "2400"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000c884d0db6b01394f84d012a5eedc1d2d00000000020000000000106600000001000020000000b78f8801ba8c36402f29e2cea2f4367433a2b6333086c70b17d16c604a81d437000000000e800000000200002000000006fa3630ef5a2ed9e6456e5226b0198ca93d4cd22571b4f0c43023101701b5d7200000001ee7f9ce78e173a291d728b2e85c2f1c08f95d467f061ac17eb2fa2fdd53c9d540000000835ea94c89b9a515cefe700028f7a22c03d863b915747077bc8171fb5a7495305c6da7e073e85b35a9013a843d5899f92925f250121d47543b78ac719467f7bc	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 20291be2375bd901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

chrome.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133237961062535571"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 40 IoCs

Processes:

msiexec.exechrome.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Liberica.jarfileJDK19-Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A458A8846F53DA54C990DECF1BE8938B\SetupPath = "LibericaInstallation"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A458A8846F53DA54C990DECF1BE8938B\CreateJavaSoft = "LibericaInstallation"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\Version = "318767106"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\ProductIcon = "C:\\Windows\\Installer\\{488A854A-35F6-45AD-9C09-EDFCB18E39B8}\\icon_v2.ico"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1C01B99B553B64644ADC70CF2B44FAA2\A458A8846F53DA54C990DECF1BE8938B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Liberica.jarfileJDK19-Full\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A458A8846F53DA54C990DECF1BE8938B\LibericaInstallation	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList\PackageName = "bellsoft-jdk19.0.2+9-windows-amd64-full.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Liberica.jarfileJDK19-Full\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Liberica.jarfileJDK19-Full\shell\open\command\ = "\"C:\\Program Files\\BellSoft\\LibericaJDK-19-Full\\bin\\javaw.exe\" -jar \"%1\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A458A8846F53DA54C990DECF1BE8938B\SetupJavaHome = "LibericaInstallation"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Liberica.jarfileJDK19-Full\shell\open\ = "Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A458A8846F53DA54C990DECF1BE8938B	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A458A8846F53DA54C990DECF1BE8938B\AssociateJarFiles = "LibericaInstallation"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\ = "Liberica.jarfileJDK19-Full"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Liberica.jarfileJDK19-Full\ = "Executable Jar File"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Liberica.jarfileJDK19-Full\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.jar	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Liberica.jarfileJDK19-Full	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\PackageCode = "798948DF2C3D85B4B853DEE8EC04EDE0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1C01B99B553B64644ADC70CF2B44FAA2	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Liberica.jarfileJDK19-Full\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.jar\Content Type = "application/java-archive"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\ProductName = "Liberica JDK 19 Full (64-bit)"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A458A8846F53DA54C990DECF1BE8938B\SourceList\Media\1 = ";"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

iexplore.exechrome.exechrome.exemsiexec.exetaskmgr.exe

pid	process
3552	iexplore.exe
3552	iexplore.exe
4992	chrome.exe
4992	chrome.exe
3276	chrome.exe
3276	chrome.exe
3080	msiexec.exe
3080	msiexec.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

Processes:

chrome.exe

pid	process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe
Token: SeShutdownPrivilege	4992	chrome.exe
Token: SeCreatePagefilePrivilege	4992	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

iexplore.exechrome.exe

pid	process
3552	iexplore.exe
3552	iexplore.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exe

pid	process
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4992	chrome.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe
4536	taskmgr.exe

Suspicious use of SetWindowsHookEx 32 IoCs

Processes:

iexplore.exeIEXPLORE.EXEIEXPLORE.EXEjavaw.exejavaw.exejavaw.exejavaw.exejavaw.exe

pid	process
3552	iexplore.exe
3552	iexplore.exe
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
3552	iexplore.exe
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
3528	IEXPLORE.EXE
3528	IEXPLORE.EXE
3528	IEXPLORE.EXE
3528	IEXPLORE.EXE
3220	IEXPLORE.EXE
3220	IEXPLORE.EXE
1532	javaw.exe
1532	javaw.exe
1532	javaw.exe
4348	javaw.exe
4348	javaw.exe
4348	javaw.exe
4688	javaw.exe
4688	javaw.exe
4688	javaw.exe
1792	javaw.exe
1792	javaw.exe
1792	javaw.exe
3024	javaw.exe
3024	javaw.exe
3024	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exechrome.exe

description	pid	process	target process
PID 3552 wrote to memory of 3220	3552	iexplore.exe	IEXPLORE.EXE
PID 3552 wrote to memory of 3220	3552	iexplore.exe	IEXPLORE.EXE
PID 3552 wrote to memory of 3220	3552	iexplore.exe	IEXPLORE.EXE
PID 3552 wrote to memory of 3528	3552	iexplore.exe	IEXPLORE.EXE
PID 3552 wrote to memory of 3528	3552	iexplore.exe	IEXPLORE.EXE
PID 3552 wrote to memory of 3528	3552	iexplore.exe	IEXPLORE.EXE
PID 4992 wrote to memory of 1272	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 1272	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 740	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 4156	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 4156	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe
PID 4992 wrote to memory of 3564	4992	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20230226_135503.jpg
1⤵
PID:2648

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe"
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3552

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3552 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3220

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3552 CREDAT:82954 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff87aef9758,0x7ff87aef9768,0x7ff87aef9778
2⤵
PID:1272

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:2
2⤵
PID:740

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:4156

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:3564

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:3204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3356 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:2476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4616 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4880 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:1000

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:4136

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4748 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:2356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:4700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4988 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4660

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3376 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4532

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5164 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5344 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:1388

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4620 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:64

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:1356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5604 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:228

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5284 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:3840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=4648 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:2780

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5552 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4776 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:2656

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3408 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5472 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2828 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:3732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=4760 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:3028

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5484 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:884

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5092 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:4688

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=1084 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:1
2⤵
PID:1728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:3836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6084 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:324

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:4236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:4800

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4972 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:3380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6180 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:4320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6220 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:3440

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:3472

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6348 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:8
2⤵
PID:3084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5536 --field-trial-handle=1840,i,5731183050225942072,6917205694828071058,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3276

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:2724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2476

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\bellsoft-jdk19.0.2+9-windows-amd64-full.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in System32 directory
PID:3704

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3080

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
2⤵
PID:4840

C:\Windows\System32\MsiExec.exe
C:\Windows\System32\MsiExec.exe -Embedding 67C5DDE24056F5172B28A122681090AA
2⤵
PID:1904

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:4676

C:\Users\Admin\Downloads\SKlauncher 3.0.exe
"C:\Users\Admin\Downloads\SKlauncher 3.0.exe"
1⤵
- Executes dropped EXE
PID:888

C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe
"C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3.0.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1532

C:\Windows\SYSTEM32\cmd.exe
cmd /c reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
3⤵
PID:3636

C:\Windows\system32\reg.exe
reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
4⤵
PID:3696

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\b1e90e2f87874fb29d4036f7bd9d5886 /t 2012 /p 1532
1⤵
PID:1936

C:\Users\Admin\Downloads\SKlauncher 3.0.exe
"C:\Users\Admin\Downloads\SKlauncher 3.0.exe"
1⤵
- Executes dropped EXE
PID:2016

C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe
"C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3.0.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4348

C:\Windows\SYSTEM32\cmd.exe
cmd /c reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
3⤵
PID:2160

C:\Windows\system32\reg.exe
reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
4⤵
PID:4688

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4348 -s 3108
3⤵
- Program crash
PID:4852

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\c9664dce2e1e4bae85fdcab89f07f065 /t 2012 /p 1532
1⤵
PID:424

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 736 -p 4348 -ip 4348
1⤵
PID:2132

C:\Users\Admin\Downloads\SKlauncher 3.0.exe
"C:\Users\Admin\Downloads\SKlauncher 3.0.exe"
1⤵
- Executes dropped EXE
PID:1624

C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe
"C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Downloads\SKlauncher 3.0.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3348

C:\Users\Admin\Desktop\SKlauncher 3.0.exe
"C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
1⤵
- Executes dropped EXE
PID:4744

C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe
"C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4688

C:\Windows\SYSTEM32\cmd.exe
cmd /c reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
3⤵
PID:3536

C:\Windows\system32\reg.exe
reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
4⤵
PID:4200

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4688 -s 3220
3⤵
- Program crash
PID:4552

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 444 -p 4688 -ip 4688
1⤵
PID:2308

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4536

C:\Users\Admin\Desktop\SKlauncher 3.0.exe
"C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
1⤵
- Executes dropped EXE
PID:2324

C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe
"C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1792

C:\Windows\SYSTEM32\cmd.exe
cmd /c reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
3⤵
PID:5064

C:\Windows\system32\reg.exe
reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
4⤵
PID:736

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1792 -s 3208
3⤵
- Program crash
PID:4356

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 404 -p 1792 -ip 1792
1⤵
PID:4840

C:\Users\Admin\Desktop\SKlauncher 3.0.exe
"C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
1⤵
- Executes dropped EXE
PID:3256

C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe
"C:\Program Files\BellSoft\LibericaJDK-19-Full\bin\javaw.exe" -Xms32m -Xmx256m -jar "C:\Users\Admin\Desktop\SKlauncher 3.0.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3024

C:\Windows\SYSTEM32\cmd.exe
cmd /c reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
3⤵
PID:996

C:\Windows\system32\reg.exe
reg query HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Themes\Personalize /v AppsUseLightTheme
4⤵
PID:852

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 3024 -s 3168
3⤵
- Program crash
PID:1224

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 420 -p 3024 -ip 3024
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery