xworm | 20beb07629c53d1220308f60b755f092a18b8704c0b0a287f03a44d8dd746bbe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/06/2024, 07:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Output.exe
Size 122KB
Sample240622-hz3bcsvgmn
SHA256 20beb07629c53d1220308f60b755f092a18b8704c0b0a287f03a44d8dd746bbe
MD5 3d9f689b6c9aa9ef3fcbc647f044dacc
SHA1 641d0f75de3e5e88f65b13cee6f804f3572b4daf
SHA512 95748151d86c98a77bce771c5316e113b2820d3869278e3cbe4dabdd784ccb629f9b948f0865fc9f0b13777482cfe61f6093fb4edcec98f82104412678cbb1a1
SSDEEP 3072:fptPBm8KL29+j/w9NgAwBzuNGKrOA+t9L05q4JMFEm:htZm8KL29+j/w92/gGIH+nLOJJMFE
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xworm execution persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

147.185.221.20:33255

Mutex

L38G3mo1mQdyxT1M

Attributes

Install_directory
%Public%
install_file
Discord.exe

aes.plain

Extracted

Family

xworm

Version

seems-radio.gl.at.ply.gg:2519

Attributes

Install_directory
%Temp%
install_file
USB.exe

Signatures

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral1/files/0x000800000002342d-6.dat	family_xworm
behavioral1/files/0x0007000000023431-17.dat	family_xworm
behavioral1/memory/5052-25-0x0000000000870000-0x0000000000880000-memory.dmp	family_xworm
behavioral1/memory/3272-26-0x0000000000340000-0x000000000035A000-memory.dmp	family_xworm

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2348	powershell.exe
2216	powershell.exe
4668	powershell.exe
2100	powershell.exe
3068	powershell.exe
3280	powershell.exe
228	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	Output.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	WindowsDefenderNotifiction.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefenderNotifiction.lnk	WindowsDefenderNotifiction.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsDefenderNotifiction.lnk	WindowsDefenderNotifiction.exe

Executes dropped EXE 4 IoCs

pid	Process
5052	Discord.exe
3272	WindowsDefenderNotifiction.exe
6112	Discord.exe
5700	Discord.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsDefenderNotifiction = "C:\\Users\\Admin\\AppData\\Local\\Temp\\WindowsDefenderNotifiction.exe"	WindowsDefenderNotifiction.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Public\\Discord.exe"	Discord.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133635138913586636"	chrome.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2480	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1292	chrome.exe
1292	chrome.exe
228	powershell.exe
228	powershell.exe
2348	powershell.exe
2348	powershell.exe
228	powershell.exe
2348	powershell.exe
2216	powershell.exe
2216	powershell.exe
2216	powershell.exe
4668	powershell.exe
4668	powershell.exe
4668	powershell.exe
2100	powershell.exe
2100	powershell.exe
3068	powershell.exe
3068	powershell.exe
2100	powershell.exe
3068	powershell.exe
3280	powershell.exe
3280	powershell.exe
3280	powershell.exe
3272	WindowsDefenderNotifiction.exe
1360	msedge.exe
1360	msedge.exe
4720	msedge.exe
4720	msedge.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
5212	identity_helper.exe
5212	identity_helper.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
3272	WindowsDefenderNotifiction.exe
1292	chrome.exe
1292	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
1292	chrome.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
1292	chrome.exe
4720	msedge.exe
1292	chrome.exe
4720	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3272	WindowsDefenderNotifiction.exe
Token: SeDebugPrivilege	5052	Discord.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeDebugPrivilege	228	powershell.exe
Token: SeDebugPrivilege	2348	powershell.exe
Token: SeDebugPrivilege	2216	powershell.exe
Token: SeDebugPrivilege	4668	powershell.exe
Token: SeDebugPrivilege	2100	powershell.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3280	powershell.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeDebugPrivilege	5052	Discord.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeDebugPrivilege	3272	WindowsDefenderNotifiction.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
1292	chrome.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3272	WindowsDefenderNotifiction.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 5052	1288	Output.exe	80
PID 1288 wrote to memory of 5052	1288	Output.exe	80
PID 1288 wrote to memory of 3272	1288	Output.exe	81
PID 1288 wrote to memory of 3272	1288	Output.exe	81
PID 1292 wrote to memory of 4276	1292	chrome.exe	85
PID 1292 wrote to memory of 4276	1292	chrome.exe	85
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2976	1292	chrome.exe	86
PID 1292 wrote to memory of 2472	1292	chrome.exe	87
PID 1292 wrote to memory of 2472	1292	chrome.exe	87
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88
PID 1292 wrote to memory of 4996	1292	chrome.exe	88

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Output.exe
"C:\Users\Admin\AppData\Local\Temp\Output.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Users\Admin\AppData\Roaming\Discord.exe
  "C:\Users\Admin\AppData\Roaming\Discord.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  PID:5052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2348
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4668
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Public\Discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3068
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'Discord.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3280
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Discord" /tr "C:\Users\Public\Discord.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2480
- C:\Users\Admin\AppData\Roaming\WindowsDefenderNotifiction.exe
  "C:\Users\Admin\AppData\Roaming\WindowsDefenderNotifiction.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\WindowsDefenderNotifiction.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:228
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'WindowsDefenderNotifiction.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2216
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\WindowsDefenderNotifiction.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2100

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc885ab58,0x7ffcc885ab68,0x7ffcc885ab78
  2⤵
  PID:4276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:2
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2280 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3936 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5016 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4332 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:5028
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ff70299ae48,0x7ff70299ae58,0x7ff70299ae68
    3⤵
    PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4864 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4400 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5024 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4016 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3432 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:8
  2⤵
  PID:5760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=848 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:2
  2⤵
  PID:5556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=1692 --field-trial-handle=1936,i,17702657317757977610,6058007844053572790,131072 /prefetch:1
  2⤵
  PID:5644

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffcc57846f8,0x7ffcc5784708,0x7ffcc5784718
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1300 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,10013765724416291665,9231629514762005268,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3508 /prefetch:2
  2⤵
  PID:5100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:428

C:\Users\Public\Discord.exe
C:\Users\Public\Discord.exe
1⤵
- Executes dropped EXE
PID:6112

C:\Users\Public\Discord.exe
C:\Users\Public\Discord.exe
1⤵
- Executes dropped EXE
PID:5700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20240622071145.pma

Path C:\Program Files\Google\Chrome\Application\SetupMetrics\20240622071145.pma
Size 488B
SHA256 338ddefb963d5042cae01de7b87ac40f4d78d1bfa2014ff774036f4bc7486783
MD5 6d971ce11af4a6a93a4311841da1a178
SHA1 cbfdbc9b184f340cbad764abc4d8a31b9c250176
SHA512 c58b59b9677f70a5bb5efd0ecbf59d2ac21cbc52e661980241d3be33663825e2a7a77adafbcec195e1d9d89d05b9ccb5e5be1a201f92cb1c1f54c258af16e29f
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 7KB
SHA256 531381f41bcef819fe86980b064e8a4512e9fa982a1e889d4c1c48b6ca147485
MD5 9fa6f0bf1e346f0bf64336149c03abf6
SHA1 f7e2b8d8fe2e6f52cd2012c71acf826212691f45
SHA512 72590ca6a9b6bf3af599dd724830d39bb7ee1a723e219fdaa6b7c6d9f9c5f646224a2d945cc40faba8fd89bb31c0a46e68a9a1046be232fce3cb3f960de9e991
SSDEEP 192:RevmpuPZaJao8syh+F6Xg6KFP5tjEsXtScR:8vmcEaCyqD6wtIsXtScR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 2768cb4f2a8818dc10ecc639423eff62e865e78db38cbcea650c2cbfa0949775
MD5 e2b3379245c2d4516d35363001d0821b
SHA1 f07376dedeed57c6297f1b94d16db24eb5381c16
SHA512 e8e74411f220aa9f278634ec1792577ca475347a287b877da3074ff77296f70006a3ad1d8221d89ad68320f991256f13e99141f4a121079cfd74b8493afccd36
SSDEEP 6144:yZ5IZXqXHjTdCP3y/MQYRPILxZnhLMJjX0EeGzY2rLK:OsqlGSMQ5fnReEFsLLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 1f4b7ace45968c56ec965def2a7d9709190e437b0cf3aa7b2655ded39d353321
MD5 5dd436be87f71f4ba6011346eb95ec35
SHA1 ef56047820e0fe258939a432520ee241abf2a0b6
SHA512 30b7e205072560679ff7b6741c7a6ad771b9b88c1c1522985a2dfed3a672604a73c2df78d1ed5d00f03e59e3621e73a78d95ee5948e608434cadd16b14a91f3b
SSDEEP 6144:pZ5IZXqXHjTdCP3y/hQYRPILxZnhLMJjX0EeGzY2rLK:lsqlGShQ5fnReEFsLLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 257KB
SHA256 c1c13283eb2bf714a32b474681bd6ded07b62f514602879c3812800d23f451a2
MD5 8d70fdbcfbcfa2288aec368c36dbca52
SHA1 25731774debc5c37076afdea1393df9820638c26
SHA512 4ff5e6a35eed602baa02bbc84f833ca1b188b3cb517513c855803f9befe0250a91cccc162c90a020d262fbd214ea3eb15c125cc84a8fc472c07a43dcfbdd80ca
SSDEEP 6144:mZ5IZXqXHjTdCP3y/hQYRPILxZnhLMJjX0EeGzY2rLK:qsqlGShQ5fnReEFsLLK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 91KB
SHA256 c1867e42ed5326e2e805afdb6897a39b0327403c3775d00ea96ab93ee2e4c2a1
MD5 383400f1271ec2b7d7c345ef462cc974
SHA1 746a155927998e04e4492ad4caedd6fd5ddd6506
SHA512 153a2ea7a280cc2601b5e277217a18b7cc69e741481144da2b03cdc93ade5a80ab970f12d9e44cd532197e9c2090c840ac8adf50147eab8130bd249eea7cc1a0
SSDEEP 384:dXUdxEQbl7t3ZOU0eY5Hf1gp9l8eREvLHanoTLtP+EubQxbpqOMVfzPzQ0XnJlL1:CiQauF9cDfL64TG2KHG1rO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache
Size 88KB
SHA256 2a54c74953b55d4c30fd18e4a594173c24c82ea7cd8e5960effe671bb4c07ae6
MD5 5e43b34e3b09c3af59fccc81ec786842
SHA1 a6ead3261757bddec36cec859056ace2b337aabe
SHA512 3fbf8072e1119d6846ba95322fc32887742fd89dcfaddb846f25b54ca24b8a589e7d5cda36eadaf2e7bdb1b2a79525354fd130a2689dc1d1828da7c6bee739bc
SSDEEP 384:vXUdxEQbl7t3ZOU0eY5Hf1gp9l8eREvGanoTLtP+EubQxbpqSVfzPzQ0XnJlLnLL:UiQauFDcDfL64TG2KHG1A
MD5 SHA1 SHA512 SSDEEP

Submit Download

Module Info Cache~RFe57ce3d.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57ce3d.TMP
Size 87KB
SHA256 5fa430367c696ac499b473d82b4d9afd905798dced3fbaf01d00b13a05ac442c
MD5 7ef3187ad6468bc2303ee68d7933b683
SHA1 a473be04e0fcf7356a0b3b770143742094d4db4c
SHA512 74b25978ff08bd73aaf6cd9d6dc680a2d97f8dc2a123e911a4c50068cdb66b3bddd8ce280791a3d610a152d5149c3e731eb4cf14986216a9fd691e4f98473ef0
SSDEEP 384:3XUdxEQbl7t3ZOU0eY5Hf1gp9l8eREvGanoTLtP+EubQxbpqSVfzPzQ0XnJlLnLz:siQauFDcDfL64TG2KMG1J
MD5 SHA1 SHA512 SSDEEP

Submit Download

Discord.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Discord.exe.log
Size 654B
SHA256 e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
MD5 2ff39f6c7249774be85fd60a8f9a245e
SHA1 684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA512 1d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
MD5 SHA1 SHA512

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 47abf0f880e8458fa4bdb31f349d6fd91ab28cf7c137e55b27a9718bbe73d8b1
MD5 1f64d37f63aae79047de961ce2cd3ab1
SHA1 5caed29e3ca5b008edd994a5a8b653b64ad9eaac
SHA512 39d3675e1e70f479b0509b4ff31e4f99d688db63f5dc785628201490683d0fe951ddcc34dd35a73004d64338e12d5718c2fd75f1dd28da8707b0ad64af9216ce
SSDEEP 96:nlkpN1RJaZjuwpvWMoiVmdeHvSSeUWQyV+VDCziEwb:nlk/LJaZjuGWMXUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 319e4ab6211f8fc28ddc171c3a35513e29490704c134b3a24ff8d76eda3735f7
MD5 45c0c8597136927b4c35d12f365c65a1
SHA1 186ed608cb69092b81f1069b738bba612e99f418
SHA512 c60e5273ff78f0b5cfa2405a2d3f059ea13f6aba24b7797b9ddbd7b9ad3f960dab25eeb9f70f8a62fd78d3d8ead9a6076254204466d3dc19fd59151e8871568e
SSDEEP 96:nlkpN1RJaZjuwpvWMoiVmdeHvSSeUWQyV+VD7AiEwb:nlk/3JaZjuGWMXUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

a79808a0-ed4a-4256-8cfc-cfe64b876c8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a79808a0-ed4a-4256-8cfc-cfe64b876c8a.tmp
Size 6KB
SHA256 4d2548cf1beb86b95eaebaec4d52deaf36e64843bba506c6a66d59ba29264ee6
MD5 02d503fe86bfae061f3f32a5e98b8dae
SHA1 d883b650fbe8570649c1b22328dc43d45e52c592
SHA512 656d385d2085cabd7bbca575858f096ccd21ff600c820a213fe26e471dbf05392cf9961e11aebd57833ed8fff09fffc2583bad821f2b03dc4775df237ad96a8f
SSDEEP 96:nlkTN1RJaZjuwpvWMoiVmdeHvSSeUWQyV+VD7AiEwb:nlkR3JaZjuGWMXUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 088074e9dcce026e232948a12ee811178fb61d4d760bc3699524a3716653d4b3
MD5 c04c97ac627588109dfaf753fd7ed2fb
SHA1 507413dac5602a2225a2305dc30b3762e9e94abe
SHA512 7c0dee370cdac38bc6105af541b70969450191f9c841c94581f34272d15e5ec03b8a0c62e0d22b7a9d1cc7173acde5c09139641ff5b5c191dbef63269654b93a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuph9Le2RUB4u6:A9iIxuERzA83h09RZxYh9b86
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 5ab6a1726f425c6d0158f55eb8d81754ddedd51e651aa0a899a29b7a58619c4c
MD5 6d42b6da621e8df5674e26b799c8e2aa
SHA1 ab3ce1327ea1eeedb987ec823d5e0cb146bafa48
SHA512 53faffbda8a835bc1143e894c118c15901a5fd09cfc2224dd2f754c06dc794897315049a579b9a8382d4564f071576045aaaf824019b7139d939152dca38ce29
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 2b139c74072ccbdaa17b950f32a6dbc934dfb7af9973d97c9b0d9c498012ba68
MD5 d8cb3e9459807e35f02130fad3f9860d
SHA1 5af7f32cb8a30e850892b15e9164030a041f4bd6
SHA512 045239ba31367fbdd59e883f74eafc05724e23bd6e8f0c1e7171ea2496a497eb9e0cfcb57285bb81c4d569daadba43d6ef64c626ca48f1e2a59e8d97f0cc9184
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_odi1q232.mvx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_odi1q232.mvx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

Discord.exe

Path C:\Users\Admin\AppData\Roaming\Discord.exe
Size 37KB
SHA256 db77279f6b996ae07ac5fd3b1edb3ecf9525087c96bbcf2d7a2a4c100db2cc7b
MD5 5c68aeb4a851c6e926ead1ff59f90640
SHA1 43771d2ff223f80c51a4907786037e746160d0fc
SHA512 074e91d484a5fbcac50f947a5c2daea247ba57f3ebdf93381d7710aa5e29f7a123fda2147764880f681694fb2cc2e86c2ef5a0fef638a2fe7db0c73104bb8172
SSDEEP 768:OEVqIZbwCxWaAXFyw9OY+v6sO/hKPSKAxC:O8qIZb9xKFP9h+6sO/MvAU
MD5 SHA1 SHA512 SSDEEP

Submit Download

WindowsDefenderNotifiction.exe

Path C:\Users\Admin\AppData\Roaming\WindowsDefenderNotifiction.exe
Size 75KB
SHA256 2269b6b2ab54b423f56ef92c05c9c48d678f0267643f07b3b854a1b7d38edb32
MD5 542aa54123357a7c4823e5a88d0acc8f
SHA1 780b3298ad77b7c24af9dd1ad84c61186ca5bca3
SHA512 2eb408d4ca8a0dd6ec9ffac4b934e0ce3d8df77dec3410b4a20f3b922e42ab664c62b5f260f6540dbbb42fda163a3577cc027c2caf19ae0223ddcc441c5c6639
SSDEEP 1536:WLtDSQOwb9aWyBfo1PaPFn+boe5uK685+69dOKyfjO3z5q3V:WIRWyBfotaPwboeZOKyfa38V
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/228-89-0x00000219A5E00000-0x00000219A5E22000-memory.dmp

Download

memory/1288-0-0x00007FFCCB8F3000-0x00007FFCCB8F5000-memory.dmp

Download

memory/1288-1-0x0000000000AA0000-0x0000000000AC4000-memory.dmp

Download

memory/3272-207-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/3272-224-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/3272-28-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/3272-26-0x0000000000340000-0x000000000035A000-memory.dmp

Download

memory/3272-29-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/5052-206-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/5052-25-0x0000000000870000-0x0000000000880000-memory.dmp

Download

memory/5052-27-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download

memory/5052-30-0x00007FFCCB8F0000-0x00007FFCCC3B1000-memory.dmp

Download