hxxps://github[.]com/Dfmaaa/MEMZ-virus

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2768-24817-0x0000000000400000-0x0000000000603000-memory.dmp	upx
behavioral1/memory/2768-24818-0x0000000000400000-0x0000000000603000-memory.dmp	upx
behavioral1/memory/4912-24819-0x0000000000400000-0x0000000000603000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{b6178a40-1665-4565-b73e-48dd6e039a65} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{b6178a40-1665-4565-b73e-48dd6e039a65}\\python-3.12.2-amd64.exe\" /burn.runonce"	python-3.12.2-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
210	raw.githubusercontent.com
211	raw.githubusercontent.com
212	camo.githubusercontent.com
213	camo.githubusercontent.com

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI3A06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd15.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd29.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE666.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D552469C-E810-468F-A139-1EA43D0E2BE0}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF204.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd42.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd65.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd73.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{94087C99-E4F5-4637-A789-3B6059DF787B}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{48AF1934-24C8-4B0F-8FDB-EDF1CAC997CE}	msiexec.exe
File created	C:\Windows\Installer\e5acd23.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd6a.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd2d.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd2e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd33.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd56.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd4b.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd5f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd24.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd38.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd3d.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3DEF.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7F2D9CC8-32A9-44B8-B759-129B34F83724}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC5FB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acd15.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8896.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIACF1.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acd55.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd6a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI47B3.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4534F2ED-1616-434D-98A6-0DA358DCD466}	msiexec.exe
File created	C:\Windows\Installer\e5acd1e.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd1f.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd3d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D219E815-E030-45D0-9AB6-01124550530D}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53CB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI57A4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI24CD.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acd32.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd41.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd69.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI37A4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A8B8EAE5-9521-43E2-8851-2ABE722FB120}	msiexec.exe
File created	C:\Windows\Installer\e5acd4c.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd5a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A9785A87-3F66-4316-9E80-499BB6F43B47}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd38.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd3c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd6f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID36E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5acd1a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{BDE73EDC-76AE-475D-8885-9B583631B0FC}	msiexec.exe
File created	C:\Windows\Installer\e5acd46.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd51.msi	msiexec.exe
File created	C:\Windows\Installer\e5acd19.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9BE09C43-7296-4B09-8CB7-138A879CAD32}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI12F8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd51.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5acd79.msi	msiexec.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 11 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.Extension\DefaultIcon	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{A8B8EAE5-9521-43E2-8851-2ABE722FB120}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{D552469C-E810-468F-A139-1EA43D0E2BE0}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\ = "Python File"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.ArchiveFile\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{C7291D11-1F03-4A72-9191-3273394D2704}\ = "{C7291D11-1F03-4A72-9191-3273394D2704}"	python-3.12.2-amd64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpCleanupState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{3B36061E-A25F-4E12-BFD1-68E724723D48}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{48AF1934-24C8-4B0F-8FDB-EDF1CAC997CE}	python-3.12.2-amd64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CacheVersion = "1"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.ArchiveFile\DefaultIcon\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\",5"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{3B36061E-A25F-4E12-BFD1-68E724723D48}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\.pyo	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.CompiledFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{BD32BDE9-835D-4013-8F9A-45FF11456F02}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.CompiledFile\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConArchiveFile\shellex\DropHandler	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\ = "{4534F2ED-1616-434D-98A6-0DA358DCD466}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DOMStorage	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\.pyzw	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{94087C99-E4F5-4637-A789-3B6059DF787B}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\Shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Launcher\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.ArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{4534F2ED-1616-434D-98A6-0DA358DCD466}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConFile\Shell	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit312\MUIVerb = "Edit with IDLE 3.12 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\ = "{BDE73EDC-76AE-475D-8885-9B583631B0FC}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{7F2D9CC8-32A9-44B8-B759-129B34F83724}	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{A8B8EAE5-9521-43E2-8851-2ABE722FB120}\Dependents	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{ED1A14A2-41CA-4C0F-A193-4D67E57D9643}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{3CF2DF73-4588-4F01-BE17-AEDEC28BE5F2}\DisplayName = "Python 3.12.2 Development Libraries (64-bit debug)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\ = "{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{B50C92E9-2780-433A-AA61-E9F06D0AFF8A}\DisplayName = "Python 3.12.2 Tcl/Tk Support (64-bit)"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConFile\Shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{ED1A14A2-41CA-4C0F-A193-4D67E57D9643}\ = "{ED1A14A2-41CA-4C0F-A193-4D67E57D9643}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{32402C92-7DD3-48EE-92C2-C798FC90EEAE}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{E172CAF3-ABC7-4B62-BA8C-3A2472DE44F6}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{BDE73EDC-76AE-475D-8885-9B583631B0FC}\ = "{BDE73EDC-76AE-475D-8885-9B583631B0FC}"	python-3.12.2-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1904519900-954640453-4250331663-1000\{67536218-57B7-4B71-B449-23B9B8905F35}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cloudexperiencehost_cw5n1h2txyewy\Internet Explorer\DomStorageState\EdpState = "0"	wwahost.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.File\shellex	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Python.NoConArchiveFile\shell\open	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{097D2A37-E94B-4FAD-8C89-D63443BD4D4A}\Version = "3.12.2150.0"	python-3.12.2-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{E0FBC883-1232-4CCC-BA54-02B4B5AC8D1C}\Dependents\{b6178a40-1665-4565-b73e-48dd6e039a65}	python-3.12.2-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000_Classes\Installer\Dependencies\{F131E2DD-B8C5-42F3-85B7-3D4BAC9582CD}\DisplayName = "Python 3.12.2 Development Libraries (64-bit)"	python-3.12.2-amd64.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Sin confirmar 22432.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 22432.crdownload:SmartScreen	msedge.exe
File created	C:\Users\Admin\Downloads\Sin confirmar 103858.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Sin confirmar 103858.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
5320	msedge.exe
5320	msedge.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5916	msedge.exe
5916	msedge.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
6100	msedge.exe
6100	msedge.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
5940	msiexec.exe
4036	msedge.exe
4036	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5540	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	5144	7zG.exe
Token: 35	5144	7zG.exe
Token: SeSecurityPrivilege	5144	7zG.exe
Token: SeSecurityPrivilege	5144	7zG.exe
Token: SeShutdownPrivilege	2356	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	2356	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	5940	msiexec.exe
Token: SeCreateTokenPrivilege	2356	python-3.12.2-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	2356	python-3.12.2-amd64.exe
Token: SeLockMemoryPrivilege	2356	python-3.12.2-amd64.exe
Token: SeIncreaseQuotaPrivilege	2356	python-3.12.2-amd64.exe
Token: SeMachineAccountPrivilege	2356	python-3.12.2-amd64.exe
Token: SeTcbPrivilege	2356	python-3.12.2-amd64.exe
Token: SeSecurityPrivilege	2356	python-3.12.2-amd64.exe
Token: SeTakeOwnershipPrivilege	2356	python-3.12.2-amd64.exe
Token: SeLoadDriverPrivilege	2356	python-3.12.2-amd64.exe
Token: SeSystemProfilePrivilege	2356	python-3.12.2-amd64.exe
Token: SeSystemtimePrivilege	2356	python-3.12.2-amd64.exe
Token: SeProfSingleProcessPrivilege	2356	python-3.12.2-amd64.exe
Token: SeIncBasePriorityPrivilege	2356	python-3.12.2-amd64.exe
Token: SeCreatePagefilePrivilege	2356	python-3.12.2-amd64.exe
Token: SeCreatePermanentPrivilege	2356	python-3.12.2-amd64.exe
Token: SeBackupPrivilege	2356	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	2356	python-3.12.2-amd64.exe
Token: SeShutdownPrivilege	2356	python-3.12.2-amd64.exe
Token: SeDebugPrivilege	2356	python-3.12.2-amd64.exe
Token: SeAuditPrivilege	2356	python-3.12.2-amd64.exe
Token: SeSystemEnvironmentPrivilege	2356	python-3.12.2-amd64.exe
Token: SeChangeNotifyPrivilege	2356	python-3.12.2-amd64.exe
Token: SeRemoteShutdownPrivilege	2356	python-3.12.2-amd64.exe
Token: SeUndockPrivilege	2356	python-3.12.2-amd64.exe
Token: SeSyncAgentPrivilege	2356	python-3.12.2-amd64.exe
Token: SeEnableDelegationPrivilege	2356	python-3.12.2-amd64.exe
Token: SeManageVolumePrivilege	2356	python-3.12.2-amd64.exe
Token: SeImpersonatePrivilege	2356	python-3.12.2-amd64.exe
Token: SeCreateGlobalPrivilege	2356	python-3.12.2-amd64.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe
Token: SeRestorePrivilege	5940	msiexec.exe
Token: SeTakeOwnershipPrivilege	5940	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
5144	7zG.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
2356	python-3.12.2-amd64.exe
636	firefox.exe
636	firefox.exe
636	firefox.exe
636	firefox.exe
3284	msedge.exe
3852	python-3.12.2-amd64.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of SendNotifyMessage 51 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
636	firefox.exe
636	firefox.exe
636	firefox.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe
5916	msedge.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
5540	OpenWith.exe
636	firefox.exe
2940	wwahost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1192	3284	msedge.exe	105
PID 3284 wrote to memory of 1192	3284	msedge.exe	105
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 4296	3284	msedge.exe	106
PID 3284 wrote to memory of 1480	3284	msedge.exe	107
PID 3284 wrote to memory of 1480	3284	msedge.exe	107
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108
PID 3284 wrote to memory of 4960	3284	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Dfmaaa/MEMZ-virus
1⤵
PID:532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5020 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:1
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5108 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:1
1⤵
PID:2300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5708 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:8
1⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --mojo-platform-channel-handle=5364 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:1
1⤵
PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --mojo-platform-channel-handle=5488 --field-trial-handle=2236,i,16103400281633466188,10996463518827761450,262144 --variations-seed-version /prefetch:1
1⤵
PID:5028

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\2114be0dedae49798bcba6481685b9dd /t 3360 /p 2256
1⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\UnblockTrace.mht
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x304,0x7ffbd6112e98,0x7ffbd6112ea4,0x7ffbd6112eb0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2040 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2352 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2748 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3440 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3652 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5032 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=5260 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5608 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5608 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5844 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6040 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3816 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=es --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=5972 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6300 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6444 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=728 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4744 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6420 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5012 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6572 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5288 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6740 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=6788 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=6492 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=7016 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=6968 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5340 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=es --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=6520 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=6584 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=7216 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=7376 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=es --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6244 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=3652 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7708 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=8100 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=3520 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=7692 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=7700 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=5176 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=5332 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=7204 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=8092 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=es --service-sandbox-type=icon_reader --no-appcompat-clear --mojo-platform-channel-handle=5824 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7224 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=7188 --field-trial-handle=2144,i,8787820048548542427,15488738848668963396,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:5916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x254,0x258,0x25c,0x250,0x2a8,0x7ffbd6112e98,0x7ffbd6112ea4,0x7ffbd6112eb0
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3084 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:2
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=3320 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:3
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=3564 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4424 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:4396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4932 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:6072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4812 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5208 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:1076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5124 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4140 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:4996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5216 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:5264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3488 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:3276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=788 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4056 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:3424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4076 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5044 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:8
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5792 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5188 --field-trial-handle=3088,i,5408997980027859681,13352055670555332616,262144 --variations-seed-version /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:4036
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x254,0x258,0x25c,0x250,0x2ac,0x7ffbd6112e98,0x7ffbd6112ea4,0x7ffbd6112eb0
      4⤵
      PID:4480
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2160 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:2
      4⤵
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2344 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:3
      4⤵
      PID:728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2500 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4348 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:2164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4348 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:1340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4632 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:3440
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=es --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --no-appcompat-clear --mojo-platform-channel-handle=4880 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4932 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:5808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5212 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5296 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:2380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --no-appcompat-clear --lang=es --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5432 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:1
      4⤵
      PID:1204
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=5476 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:2924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=es --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4404 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=es --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4672 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:6044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAABEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=4292 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2796
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3840 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:1808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=es --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3868 --field-trial-handle=2172,i,221096284745151669,11257429882190301585,262144 --variations-seed-version /prefetch:8
      4⤵
      PID:3776

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5912

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Blank-Grabber-main\" -spe -an -ai#7zMap11950:98:7zEvent15296
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:5560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Blank-Grabber-main.zip\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:5196

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5540

C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
1⤵
- Executes dropped EXE
PID:736
- C:\Windows\Temp\{7CF32AA5-1B58-4756-B978-6B4FCFBF4814}\.cr\python-3.12.2-amd64.exe
  "C:\Windows\Temp\{7CF32AA5-1B58-4756-B978-6B4FCFBF4814}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=568 -burn.filehandle.self=720
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:2356

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5940
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4232C854FE3B1E881B2AB3C948FDFD49
  2⤵
  - Loads dropped DLL
  PID:3600
- - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5076
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpock3mpod\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpock3mpod', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2608

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:516
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="636.0.1554515190\991317631" -parentBuildID 20221007134813 -prefsHandle 1880 -prefMapHandle 1872 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1d907e8e-d0e2-46e0-b802-10d44a940b27} 636 "\\.\pipe\gecko-crash-server-pipe.636" 1960 298cd8f3158 gpu
    3⤵
    PID:2988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="636.1.867669522\1796843657" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2340 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {690e1ae8-3667-4cc1-8a9c-6b5ed8ab6b82} 636 "\\.\pipe\gecko-crash-server-pipe.636" 2364 298cd233b58 socket
    3⤵
    - Checks processor information in registry
    PID:1092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="636.2.2013587849\1657721722" -childID 1 -isForBrowser -prefsHandle 3020 -prefMapHandle 3036 -prefsLen 20823 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79231823-42ab-4d15-b924-77fb731fed0b} 636 "\\.\pipe\gecko-crash-server-pipe.636" 3012 298cd85a358 tab
    3⤵
    PID:5364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="636.3.1782569843\1315718297" -childID 2 -isForBrowser -prefsHandle 1384 -prefMapHandle 1728 -prefsLen 26001 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a08a20a1-3a8e-4426-8412-c7a7bb7a3dce} 636 "\\.\pipe\gecko-crash-server-pipe.636" 1280 298c0e6e058 tab
    3⤵
    PID:3096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="636.4.1622410774\722716928" -childID 3 -isForBrowser -prefsHandle 3680 -prefMapHandle 3676 -prefsLen 26001 -prefMapSize 233444 -jsInitHandle 1404 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {57e0a597-d5a2-4a17-a562-97773e12640e} 636 "\\.\pipe\gecko-crash-server-pipe.636" 3692 298c0e5f858 tab
    3⤵
    PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaultd72d67eah4696h4364h8550hf33496809587
1⤵
PID:3008

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:6036

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" TurnOffDevicePortal
1⤵
PID:1340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault7a94d1aeh3689h4775ha1d5hb72490ee490e
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefaulte749712ah2827h483dhb770h84000eab11d3
1⤵
PID:988

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:App.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2940

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\READme.txt
1⤵
PID:5960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault2419f8a2h6c50h4404had54hf2c45e7f1cfd
1⤵
PID:1548

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:5556

C:\Users\Admin\Downloads\python-3.12.2-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.2-amd64.exe"
1⤵
- Executes dropped EXE
PID:5948
- C:\Windows\Temp\{0F819E93-64BB-49B8-A67D-58ED641BECDA}\.cr\python-3.12.2-amd64.exe
  "C:\Windows\Temp\{0F819E93-64BB-49B8-A67D-58ED641BECDA}\.cr\python-3.12.2-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.2-amd64.exe" -burn.filehandle.attached=688 -burn.filehandle.self=536
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  PID:3852
- - C:\Users\Admin\AppData\Local\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe" -3.12 -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
    3⤵
    - Executes dropped EXE
    PID:5708
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3340
- - C:\Users\Admin\AppData\Local\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe" -3.12 -O -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
    3⤵
    - Executes dropped EXE
    PID:3592
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -O -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1196
- - C:\Users\Admin\AppData\Local\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe
    "C:\Users\Admin\AppData\Local\Package Cache\29104347204BF2D95418EA28730B788408D036EB\py.exe" -3.12 -OO -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
    3⤵
    - Executes dropped EXE
    PID:2852
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -OO -E -s -Wi "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib\compileall.py" -f -x "bad_coding|badsyntax|site-packages|py2_|lib2to3\\tests|venv\\scripts" "C:\Users\Admin\AppData\Local\Programs\Python\Python312\\Lib"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:4936
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2872
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import customtkinter"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4960
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -m pip install customtkinter
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4032
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import PIL"
  2⤵
  - Executes dropped EXE
  PID:6112
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -m pip install pillow
  2⤵
  - Executes dropped EXE
  PID:4248
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import pyaes"
  2⤵
  - Executes dropped EXE
  PID:4252
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -m pip install pyaesm
  2⤵
  - Executes dropped EXE
  PID:5252
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import urllib3"
  2⤵
  - Executes dropped EXE
  PID:6136
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -m pip install urllib3
  2⤵
  - Executes dropped EXE
  PID:4828
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python gui.py
  2⤵
  - Executes dropped EXE
  PID:5516

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:3736
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  PID:4120
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import customtkinter"
  2⤵
  - Executes dropped EXE
  PID:4112
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import PIL"
  2⤵
  - Executes dropped EXE
  PID:3252
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import pyaes"
  2⤵
  - Executes dropped EXE
  PID:4352
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import urllib3"
  2⤵
  - Executes dropped EXE
  PID:1408
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python gui.py
  2⤵
  - Executes dropped EXE
  PID:3576

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Components\run.bat" "
1⤵
PID:624

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Components\run.bat" "
1⤵
PID:2632

C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Components\upx.exe
"C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Components\upx.exe"
1⤵
- Executes dropped EXE
PID:2768

C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Components\upx.exe
"C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Components\upx.exe"
1⤵
- Executes dropped EXE
PID:4912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://%22c/Users/Admin/Downloads/Blank-Grabber-main/Blank%20Grabber/gui.py
1⤵
PID:3616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\Builder.bat" "
1⤵
PID:540
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python --version
  2⤵
  - Executes dropped EXE
  PID:5296
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import customtkinter"
  2⤵
  - Executes dropped EXE
  PID:2936
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import PIL"
  2⤵
  - Executes dropped EXE
  PID:4432
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import pyaes"
  2⤵
  - Executes dropped EXE
  PID:3352
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python -c "import urllib3"
  2⤵
  - Executes dropped EXE
  PID:5172
- C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
  python gui.py
  2⤵
  - Executes dropped EXE
  PID:2636

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Blank-Grabber-main\Blank Grabber\READme.txt
1⤵
PID:1032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery