zloader | 679ee0ceaba9746953c50878249906e0e2e5526d8e355640051e29040b64488b

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\L3APD-135\ImagePath = "\\??\\C:\\Windows\\System32\\Drivers\\L3APD.sys"	mapper.exe

Deletes itself 1 IoCs

pid	Process
2292	7zFM.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 40 IoCs

pid	Process
1172	Ninite WinRAR Installer.exe
4640	Ninite.exe
1832	target.exe
3264	uninstall.exe
2720	RarExtInstaller.exe
3364	WinRAR.exe
3964	RarExtInstaller.exe
1636	WinRAR.exe
1112	loader.exe
3748	loader.exe
1344	SyncInfrastructure.exe
11120	WinRAR.exe
1340	1.exe
1804	BearShare_V9_en_Setup.exe
9880	BearShare.exe
8508	SetupDataMngr_BearShare.exe
5144	nsb44FF.tmp.exe
7704	BEARSH~2.EXE
5460	GLJ4685.tmp
3612	MSID4D7.tmp
3596	installer.exe
920	setup.exe
9136	setup.exe
5704	setup.exe
2064	setup.exe
1952	epibrowser.exe
6500	epibrowser.exe
6740	epibrowser.exe
5236	epibrowser.exe
6872	epibrowser.exe
6040	epibrowser.exe
11876	epibrowser.exe
2316	epibrowser.exe
10024	MSI4E8C.tmp
11412	5.exe
10560	6.exe
5008	WebCompanion-Installer.exe
9536	WebCompanion.exe
8752	upd.exe
10264	WebCompanion.exe

Loads dropped DLL 64 IoCs

pid	Process
3356	Process not Found
2276	Process not Found
3748	loader.exe
3748	loader.exe
3748	loader.exe
3748	loader.exe
3748	loader.exe
3748	loader.exe
5064	Process not Found
5328	Process not Found
2244	Process not Found
3356	Process not Found
5240	Process not Found
4572	Process not Found
6344	Process not Found
10752	Process not Found
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
6120	MsiExec.exe
6120	MsiExec.exe
6120	MsiExec.exe
6120	MsiExec.exe
2448	MsiExec.exe
2448	MsiExec.exe
9024	MsiExec.exe
7756	MsiExec.exe
4776	MsiExec.exe
3952	MsiExec.exe
1424	MsiExec.exe
492	MsiExec.exe
7436	MsiExec.exe
11496	MsiExec.exe
7688	MsiExec.exe

Modifies system executable filetype association 2 TTPs 4 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-8EE4-11D2-9906-E49FADC173CA}\	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers\{B41DB860-64E4-11D2-9906-E49FADC173CA}\	uninstall.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver Utility = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\CloudStore\\driver_utility.exe"	SyncInfrastructure.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\!BearShareCHROME = "RUNDLL32.EXE C:\\Users\\Admin\\AppData\\Local\\Temp\\INSTAL~1.DLL,_SetChromeAssets http://search.bearshare.com/,http://search.bearshare.com/web?src=crb&q={searchTerms},Web Search,b,"	nsb44FF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\EpiBrowserStartup = "\"C:\\Users\\Admin\\AppData\\Local\\EPISoftware\\EpiBrowser\\Application\\epibrowser.exe\" --from-registry"	epibrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\EpiBrowserUpdate = "\"C:\\Users\\Admin\\AppData\\Local\\EPISoftware\\EpiBrowser\\Application\\epibrowser.exe\" --update"	epibrowser.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Users\\Admin\\AppData\\Roaming\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Windows\CurrentVersion\Run\Web Companion = "C:\\Users\\Admin\\AppData\\Roaming\\Lavasoft\\Web Companion\\Application\\WebCompanion.exe --minimize "	WebCompanion.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\desktop.ini	Ninite.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	Ninite.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	BearShare.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	5.exe
File opened (read-only)	\??\U:	5.exe
File opened (read-only)	\??\H:	BearShare.exe
File opened (read-only)	\??\I:	BearShare.exe
File opened (read-only)	\??\S:	BearShare.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\E:	BearShare.exe
File opened (read-only)	\??\G:	BearShare.exe
File opened (read-only)	\??\I:	5.exe
File opened (read-only)	\??\L:	5.exe
File opened (read-only)	\??\S:	5.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	BearShare.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\N:	BearShare.exe
File opened (read-only)	\??\H:	5.exe
File opened (read-only)	\??\Y:	5.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	BearShare.exe
File opened (read-only)	\??\U:	BearShare.exe
File opened (read-only)	\??\A:	5.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	BearShare.exe
File opened (read-only)	\??\G:	5.exe
File opened (read-only)	\??\T:	5.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\V:	5.exe
File opened (read-only)	\??\W:	5.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\A:	BearShare.exe
File opened (read-only)	\??\J:	BearShare.exe
File opened (read-only)	\??\W:	BearShare.exe
File opened (read-only)	\??\Z:	BearShare.exe
File opened (read-only)	\??\O:	5.exe
File opened (read-only)	\??\O:	BearShare.exe
File opened (read-only)	\??\X:	BearShare.exe
File opened (read-only)	\??\K:	5.exe
File opened (read-only)	\??\Q:	5.exe
File opened (read-only)	\??\Z:	5.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	5.exe
File opened (read-only)	\??\R:	5.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\P:	BearShare.exe
File opened (read-only)	\??\R:	BearShare.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\E:	5.exe
File opened (read-only)	\??\M:	BearShare.exe
File opened (read-only)	\??\Y:	BearShare.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0974BA1E-64EC-11DE-B2A5-E43756D89593}\ = "MediaBar"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}	GLJ4685.tmp

Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service

T1102

flow	ioc
3	camo.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	epibrowser.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	epibrowser.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	nsb44FF.tmp.exe
File created	C:\Windows\SysWOW64\logs.txt	upd.exe
File created	C:\Windows\System32\SyncInfrastructure.exe	loader.exe
File opened for modification	C:\Windows\System32\SyncInfrastructure.exe	loader.exe

Enumerates processes with tasklist 1 TTPs 64 IoCs

discovery

Process Discovery

T1057

pid	Process
2268	tasklist.exe
3120	tasklist.exe
3604	tasklist.exe
540	tasklist.exe
4552	tasklist.exe
2284	tasklist.exe
3804	tasklist.exe
3024	tasklist.exe
4796	tasklist.exe
1984	tasklist.exe
4200	tasklist.exe
2080	tasklist.exe
4728	tasklist.exe
3160	tasklist.exe
1944	tasklist.exe
1512	tasklist.exe
2852	tasklist.exe
4908	tasklist.exe
2448	tasklist.exe
5108	tasklist.exe
2972	tasklist.exe
4080	tasklist.exe
3908	tasklist.exe
2216	tasklist.exe
568	tasklist.exe
2732	tasklist.exe
1812	tasklist.exe
2572	tasklist.exe
3604	tasklist.exe
3340	tasklist.exe
1932	tasklist.exe
1048	tasklist.exe
2268	tasklist.exe
1300	tasklist.exe
4900	tasklist.exe
2156	tasklist.exe
4684	tasklist.exe
4048	tasklist.exe
3656	tasklist.exe
3044	tasklist.exe
4720	tasklist.exe
3400	tasklist.exe
1524	tasklist.exe
2268	tasklist.exe
4416	tasklist.exe
2732	tasklist.exe
3700	tasklist.exe
2160	tasklist.exe
3824	tasklist.exe
1376	tasklist.exe
3040	tasklist.exe
3476	tasklist.exe
4896	tasklist.exe
3520	tasklist.exe
2732	tasklist.exe
3428	tasklist.exe
1724	tasklist.exe
5108	tasklist.exe
1788	tasklist.exe
1872	tasklist.exe
1580	tasklist.exe
3896	tasklist.exe
2272	tasklist.exe
744	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3428	mapper.exe
3652	mapper.exe

UPX packed file 49 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0002000000025e69-2990.dat	upx
behavioral1/memory/1112-3018-0x00007FF668D70000-0x00007FF668DED000-memory.dmp	upx
behavioral1/memory/1344-3036-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/files/0x0002000000025e89-3037.dat	upx
behavioral1/memory/1112-3049-0x00007FF668D70000-0x00007FF668DED000-memory.dmp	upx
behavioral1/memory/3748-3050-0x00007FF668D70000-0x00007FF668DED000-memory.dmp	upx
behavioral1/memory/1344-3054-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3053-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3058-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/3748-3068-0x00007FF668D70000-0x00007FF668DED000-memory.dmp	upx
behavioral1/memory/1112-3070-0x00007FF668D70000-0x00007FF668DED000-memory.dmp	upx
behavioral1/memory/1344-3080-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3081-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3082-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3105-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3224-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3344-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3354-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3460-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3483-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3503-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3517-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3547-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3566-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3585-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3586-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3596-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3635-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-3827-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-4723-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-5784-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-6270-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8317-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8359-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8452-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8511-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8566-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8587-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8601-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8617-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8620-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8652-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8703-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8752-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8851-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8872-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/1344-8970-0x00007FF688610000-0x00007FF688AFC000-memory.dmp	upx
behavioral1/memory/9880-16669-0x0000000010000000-0x0000000010212000-memory.dmp	upx
behavioral1/memory/9880-17461-0x0000000010000000-0x0000000010212000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\comcast.png	BEARSH~2.EXE
File created	C:\Program Files\7-Zip\Lang\kab.txt	msiexec.exe
File opened for modification	C:\Program Files\WinRAR\RarExtLogo.altform-unplated_targetsize-32.png	target.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\rssback.gif	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\widget_allocine.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\button-splitter-vista.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\popupWeather.html	BEARSH~2.EXE
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	msiexec.exe
File opened for modification	C:\Program Files\WinRAR\WinRAR.exe	target.exe
File created	C:\Program Files\WinRAR\7zxa.dll	target.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\colorschemebubble\images\close-pressed.png	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\images\ls_btn_pressed.png	msiexec.exe
File created	C:\Program Files\7-Zip\7-zip.chm	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\de.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mn.txt	msiexec.exe
File opened for modification	C:\Program Files\WinRAR\License.txt	target.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\HTML\Recommendation_Offline.html	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\button-down-left.png	BEARSH~2.EXE
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\panels\images\scroll-bg.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\panels\images\scrollb.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\BearShare\UpdateInst.exe	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\DiscoveryHelper.dll	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\videosview\videos.html	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\panels\gametype.xsl	BEARSH~2.EXE
File created	C:\Program Files\7-Zip\Lang\cy.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mng.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\pl.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\ps.txt	msiexec.exe
File created	C:\Program Files\WinRAR\ReadMe.txt	target.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\panels\gamecategory.xsl	BEARSH~2.EXE
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\bn.txt	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\radio\images\radio-btn-play.png	BEARSH~2.EXE
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\content\lib\wmpstreamer.html	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\music.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\scroll-left.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\panels\images\ico-tags.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\uwa\border_19.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-close-greyover.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\weatherbutton\panels\images\btn-search-pnlbtm.png	BEARSH~2.EXE
File created	C:\Program Files\7-Zip\Lang\th.txt	msiexec.exe
File created	C:\Program Files\WinRAR\Uninstall.lst	target.exe
File opened for modification	C:\Program Files\WinRAR\WinCon.SFX	target.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\images\defalbum.png	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\content\lib\about.xml	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\panels\images\view-thumb-over.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\BearShare\IMTrProgress.dll	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\HTML\Images\closeRecommend.gif	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\content\widgets\net.vmn.www.3.YouTube.1217\bg-scalable-tr.gif	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\button-drop-left.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\BearShare\BerkeleyLoader.dll	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioFileWMA3.dll	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\mr.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	msiexec.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	msiexec.exe
File created	C:\Program Files\7-Zip\Lang\lv.txt	msiexec.exe
File opened for modification	C:\Program Files\WinRAR\Rar.exe	target.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\images\sbv_slider_center_over.png	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\images\th_btn_pressed.png	msiexec.exe
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\lib\highlight_lime.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\chrome\skin\skin-grey.png	BEARSH~2.EXE
File created	C:\Program Files (x86)\BearShare Applications\BearShare\Skins\html\albumsview\images\playbtn.png	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\c_volume.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmnttme.inf	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~3.0\0410\_ServiceModelServicePerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\mstape.inf	cmd.exe
File opened for modification	C:\Windows\INF\usbstor.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmgsm.inf	cmd.exe
File opened for modification	C:\Windows\INF\microsoft_bluetooth_hfp.inf	cmd.exe
File opened for modification	C:\Windows\INF\netlldp.inf	cmd.exe
File opened for modification	C:\Windows\INF\SMSvcHost 4.0.0.0\0000\_SMSvcHostPerfCounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\digitalmediadevice.inf	cmd.exe
File opened for modification	C:\Windows\INF\usbhub\usbperfsym.h	cmd.exe
File opened for modification	C:\Windows\INF\cpu.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_cdrom.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmnis5t.inf	cmd.exe
File opened for modification	C:\Windows\INF\nete1g3e.inf	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~2.0\0410\_ServiceModelOperationPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\net8187se64.inf	cmd.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\INF\rdshup.inf	cmd.exe
File opened for modification	C:\Windows\INF\WindowsTrustedRTProxy.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmmct.inf	cmd.exe
File opened for modification	C:\Windows\INF\wvmbus.inf	cmd.exe
File opened for modification	C:\Windows\INF\amdgpio2.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmsonyu.inf	cmd.exe
File opened for modification	C:\Windows\INF\MSDTC Bridge 4.0.0.0\0411\_TransactionBridgePerfCounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\rawsilo.inf	cmd.exe
File created	C:\Windows\Installer\e83f650.msi	msiexec.exe
File opened for modification	C:\Windows\INF\mdmminij.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmtdk.inf	cmd.exe
File opened for modification	C:\Windows\INF\UGatherer\0411\gsrvctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\c_ports.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_smrvolume.inf	cmd.exe
File opened for modification	C:\Windows\INF\eaphost.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmtkr.inf	cmd.exe
File opened for modification	C:\Windows\INF\cht4sx64.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_smartcard.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmgl008.inf	cmd.exe
File opened for modification	C:\Windows\INF\wstorflt.inf	cmd.exe
File opened for modification	C:\Windows\INF\wudfusbcciddriver.inf	cmd.exe
File opened for modification	C:\Windows\INF\ipoib6x.inf	cmd.exe
File opened for modification	C:\Windows\INF\SERVIC~1.0\0000\_ServiceModelEndpointPerfCounters_D.ini	cmd.exe
File opened for modification	C:\Windows\INF\netpgm.inf	cmd.exe
File opened for modification	C:\Windows\INF\rtwlanu_oldIC.inf	cmd.exe
File opened for modification	C:\Windows\INF\tpmvsc.inf	cmd.exe
File opened for modification	C:\Windows\INF\whvcrash.inf	cmd.exe
File opened for modification	C:\Windows\INF\wsearchidxpi\0411\idxcntrs.ini	cmd.exe
File opened for modification	C:\Windows\INF\c_display.inf	cmd.exe
File opened for modification	C:\Windows\INF\halextintclpiodma.inf	cmd.exe
File opened for modification	C:\Windows\INF\UGTHRSVC\040C\gthrctr.ini	cmd.exe
File opened for modification	C:\Windows\INF\vstxraid.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_sslaccel.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmhaeu.inf	cmd.exe
File opened for modification	C:\Windows\INF\pci.inf	cmd.exe
File opened for modification	C:\Windows\INF\wnetvsc.inf	cmd.exe
File opened for modification	C:\Windows\INF\xboxgipsynthetic.inf	cmd.exe
File opened for modification	C:\Windows\INF\netax88772.inf	cmd.exe
File opened for modification	C:\Windows\INF\netbxnda.inf	cmd.exe
File opened for modification	C:\Windows\INF\SDFLauncher.inf	cmd.exe
File opened for modification	C:\Windows\INF\SMSvcHost 4.0.0.0\0411\_SMSvcHostPerfCounters_d.ini	cmd.exe
File opened for modification	C:\Windows\INF\wvmgid.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_fsquotamgmt.inf	cmd.exe
File opened for modification	C:\Windows\INF\c_monitor.inf	cmd.exe
File opened for modification	C:\Windows\INF\mdmcommu.inf	cmd.exe
File opened for modification	C:\Windows\INF\wdmaudioapo.inf	cmd.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 7 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Rar$EXa3364.11734.rartemp\Release\loader.exe:Zone.Identifier	WinRAR.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$DRa1636.14854.rartemp\Release\loader.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\PDFMaker.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\btweb_installer.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\bearsharev9.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Ninite WinRAR Installer.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
6216	powershell.exe
11284	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 6 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 49 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ninite WinRAR Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BearShare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ninite.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BearShare_V9_en_Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEARSH~2.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xcopy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSI4E8C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GLJ4685.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCompanion-Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCompanion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SetupDataMngr_BearShare.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nsb44FF.tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebCompanion.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	upd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

NSIS installer 3 IoCs

installer

resource	yara_rule
behavioral1/files/0x000c00000002bb62-16983.dat	nsis_installer_1
behavioral1/files/0x000c00000002bb62-16983.dat	nsis_installer_2
behavioral1/files/0x000e00000002bb64-17452.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 14 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000097e32746e391c5270000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000097e327460000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090097e32746000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d97e32746000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000097e3274600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BearShare_V9_en_Setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	BearShare_V9_en_Setup.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WebCompanion.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WebCompanion.exe

Enumerates system info in registry 2 TTPs 23 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	epibrowser.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	epibrowser.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	epibrowser.exe

Kills process with taskkill 10 IoCs

evasion

pid	Process
1764	taskkill.exe
652	taskkill.exe
744	taskkill.exe
1568	taskkill.exe
788	taskkill.exe
4928	taskkill.exe
1100	taskkill.exe
4900	taskkill.exe
4492	taskkill.exe
336	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{977315A5-C0DB-4EFD-89C2-10AA86CA39A5}\AlternateCLSID = "{85A9BDFA-93C0-4F1B-9AB6-B92A90E5B326}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6C095616-6064-43ca-9180-CF1B6B6A0BE4}	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenAllHomePages = "1"	nsb44FF.tmp.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{76EE578D-314B-4755-8365-6E1722C001A2}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66E07EF9-4E89-4284-9632-6D6904B77732}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{652623DC-2BB4-4C1C-ADFB-57A218F1A5EE}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7EB2A2EC-1C3A-4946-9614-86D3A10EDBF3}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{05CDEE1D-D109-4992-B72B-6D4F5E2AB731}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{833E62AD-1655-499F-908E-62DCA1EB2EC6}\AlternateCLSID = "{7CAE4253-EEEF-42C7-BB94-E65EBF540DB6}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8B1A14AF-E603-4356-B687-1F7D46522DD3}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9275A865-754B-4EDF-B828-FED0F8D344FC}\AlternateCLSID = "{59BA14C3-B5CD-4DFF-8256-25961756B9B4}"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B60770C2-0390-41A8-A8DE-61889888D840}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{41473CFB-66B6-45B8-8FB3-2BC9C1FD87BA}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{A7866636-ED52-4722-82A9-6BAABEFDBF96}	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes	nsb44FF.tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{41473CFB-66B6-45B8-8FB3-2BC9C1FD87BA}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FA8932FF-E064-4378-901C-69CB94E3A20A}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{00D46195-B634-4C41-B53B-5093527FB791}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F399F5B6-3C63-4674-B0FF-E94328B1947D}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8CC18E3F-4E2B-4D27-840E-CB2F99A3A003}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{652623DC-2BB4-4C1C-ADFB-57A218F1A5EE}	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}"	nsb44FF.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}\	nsb44FF.tmp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8CC18E3F-4E2B-4D27-840E-CB2F99A3A003}\AlternateCLSID = "{070A0793-B969-4BC7-848B-3FD844554784}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{A233E654-53FF-43AA-B1E2-60DA2E89A1EC}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{285CAE3C-F16A-4A84-9A80-FF23D6E56D68}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8DBC7A04-B478-41D5-BE05-5545D565B59C}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6981B978-70D9-40B9-B00E-903B6FC8CA8A}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\AppPath = "C:\\Program Files (x86)\\BearShare Applications\\MediaBar\\ToolBar"	BEARSH~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{905BF7D7-6BC1-445A-BE53-9478AC096BEB}\AlternateCLSID = "{02F654C7-2915-45DF-94E2-8B145A060DF9}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{65FB3073-CA8E-42A1-9A9A-2F826D05A843}\AlternateCLSID = "{83803392-C613-473A-AF42-5C4D07F8FE7B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{947F2947-2296-42FE-92E6-E2E03519B895}\AlternateCLSID = "{7F4E9A4B-7D73-4D7D-9A37-30100CEE0874}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4614C49A-0B7D-4E0D-A877-38CCCFE7D589}\AlternateCLSID = "{096CBF58-FC7F-433D-9158-27DE6B22D8C7}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D9D27EE-675E-4BDE-84B1-1C9A94F98555}\AlternateCLSID = "{78E9D883-93CD-4072-BEF3-38EE581E2839}"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}\ShowSearchSuggestions = "1"	nsb44FF.tmp.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\Policy = "3"	BEARSH~2.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0270E604-387F-48ED-BB6D-AA51F51D6FC3}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{68BBCA71-E1F6-47B2-87D3-369E1349D990}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{926618A9-4035-4CD6-8240-64C58EB37B07}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CB05A177-1069-4A7A-AB0A-5E6E00DCDB76}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{974E1D88-BADF-4C80-8594-A59039C992EA}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{B60770C2-0390-41A8-A8DE-61889888D840}\AlternateCLSID = "{51B7FAF0-B98E-4A0F-9DF6-E31A81836925}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{FC28B75F-F9F6-4C92-AF91-14A3A51C49FB}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6E5E167B-1566-4316-B27F-0DDAB3484CF7}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{3D6A1A85-DE54-4768-9951-053B3B02B9B0}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2875E7A5-EE3C-4FE7-A23E-DE0529D12028}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{E1A26BBF-26C0-401d-B82B-5C4CC67457E0}	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\Enabled = "1"	nsb44FF.tmp.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\OpenInForeground = "0"	nsb44FF.tmp.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}	nsb44FF.tmp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2A69}\SuggestionsURL_JSON = "http://search.bearshare.com/suggest.php?src=ieb&qu={searchTerms}&ft=json"	nsb44FF.tmp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{CB05A177-1069-4A7A-AB0A-5E6E00DCDB76}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{4614C49A-0B7D-4E0D-A877-38CCCFE7D589}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6D9D27EE-675E-4BDE-84B1-1C9A94F98555}\Compatibility Flags = "1024"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{108092BF-B7DB-40D1-B7FB-F55922FCC9BE}\Compatibility Flags = "1024"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C2DE2E6-2AD1-4301-A6A7-DF364858EF01}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{497EE41C-CE06-4DD4-8308-6C730713C646}\Compatibility Flags = "1024"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{0B9C0C26-728C-4FDA-B8DD-59806E20E4D9}\AlternateCLSID = "{44BF597A-C391-4162-8976-B00B55C92F56}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F6A7FF1B-9951-4CBE-B197-EA554D6DF40D}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{926618A9-4035-4CD6-8240-64C58EB37B07}\AlternateCLSID = "{29C78D18-D3C3-4B8F-B7EF-F5DC2385F82E}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66E07EF9-4E89-4284-9632-6D6904B77732}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1E0D3332-7441-44FF-A225-AF48E977D8B6}\AlternateCLSID = "{72719D4A-11A5-4E33-A131-36DE83DE9C3A}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6CA73E8B-B584-4533-A405-3D6F9C012B56}	MsiExec.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://search.bearshare.com/"	nsb44FF.tmp.exe

Modifies data under HKEY_USERS 23 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\WinRAR\Interface\Misc	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Aurigma\ImageUploader\Image Uploader 5.0	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinRAR\Interface	Ninite.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\WinRAR\Interface\Misc\RemShown = "1"	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133815282246604640"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Aurigma	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Aurigma\ImageUploader\Image Uploader 5.0\LastVisitedAsStringHash = 300078007f00920084005300520053005c005f0057005800620059005b005c005e006000780030000000	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\WinRAR	Ninite.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Ninite.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Aurigma\ImageUploader	MsiExec.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Aurigma\ImageUploader\Image Uploader 5.0\LastVisitedAsString2 = 51003a00460042003b0007003b004600470007003b004500150046005100470043003c0006003a004900460006003a0048000000	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT	Ninite.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NCTAudioFile3.AudioInfo.1	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BearShareIEHelper.DNSGuard\CurVer	GLJ4685.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\938426F5D749AE64DB36DF48C7A16C1F\FWR1949	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{F0CF944C-F160-4F65-8F0A-2773322FF357}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\BearShare Applications\\MediaBar\\DataMngr"	GLJ4685.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD5175E2-7CC1-418C-B66C-0AB95DAD4103}\ProgID\ = "NCTAudioFile3.AudioFile3.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B0C99786-BE00-421A-A45E-D33006033643}\ProxyStubClsid32	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D637FAD-E202-48D1-8F18-5B9C459BD1E3}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6C9945B7-1D19-46CB-88C0-45A24DF6CD6E}\1.0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\938426F5D749AE64DB36DF48C7A16C1F\FWR2006	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{27BF8F8D-58B8-D41C-F913-B7EEB57EF6F6}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{55C1727F-5535-4C2A-9601-8C2458608B48}\1.0\0	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C6A7847E-8931-4a9a-B4EF-72A91E3CCF4D}\ = "NickelStatic Object"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B77AD4AC-C1C2-B293-7737-71E13A11FFEA}\TypeLib\ = "{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.zip	uninstall.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCTAudioFileWMA3.AudioFileWMA3.1\CLSID\ = "{87CD3140-EEC0-463F-8872-6E564D9DEDE5}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CBF1A392-079E-480D-9390-CA7067B7C2E9}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DEF4ED0D-E666-4631-A35A-A634332F0550}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCTAudioFormatSettings3.AudioFormatAAC\ = "AudioFormatAAC Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IMWeb.IMWebControl	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6559E502-6EE1-46b8-A83C-F3A45BDA23EE}\TypeLib\ = "{252C2315-CCE0-4446-8DA7-C00292A690BA}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6BC38BF4-E84D-46E1-920B-42D31AEA617E}\InprocServer32\ = "C:\\Program Files (x86)\\BearShare Applications\\BearShare\\NCTAudioFormatSettings3.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3946800C-305F-4CF8-A3C3-8C4C4C283A1D}\TypeLib\Version = "2.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\938426F5D749AE64DB36DF48C7A16C1F\F253DD188	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Nickel.Skin\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCTAudioFormatSettings3.AudioFormat\CLSID\ = "{6BC38BF4-E84D-46E1-920B-42D31AEA617E}"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\EPIPDF.7OIP4DTZMU6NMSBPJLZ273OVFE\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0974BA1E-64EC-11DE-B2A5-E43756D89593}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0734B07F-9F40-4A30-95F1-DC7C7B73A520}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5D9E7BE9-95E5-4392-8CD2-D82DE89589ED}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\96F071321C0420722210000010000000\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Desktop\\stuff\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CF0820C2-E9B2-4243-9BD2-B27586AB6374}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\938426F5D749AE64DB36DF48C7A16C1F\FWR1969	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMHelperiMesh.WMHelper\CurVer	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\EPIPDF.7OIP4DTZMU6NMSBPJLZ273OVFE\Application	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1FC41815-FA4C-4F8B-B143-2C045C8EA2FC}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EFDE11A9-FE0B-4548-B876-5EAC0A6CE86F}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74322BF9-DF26-493f-B0DA-6D2FC5E6429E}\Programmable	GLJ4685.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F42C7B47-5234-4BF5-8882-DAAC0D64870E}\TypeLib\ = "{F07FBD3E-2048-44A4-9065-71BF551E2673}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31F8B21E-8674-4589-A37F-31A4D4B55CC5}\MiscStatus\ = "0"	MsiExec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\EPIHTML.7OIP4DTZMU6NMSBPJLZ273OVFE\ = "EpiBrowser HTML Document"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{96F7FABC-5789-EFA4-B6ED-1272F4C1D27B}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\BearShare Applications\\BearShare\\"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\EPIHTML.7OIP4DTZMU6NMSBPJLZ273OVFE	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8CA0D2D1-8C40-44F1-B98E-8FDFF8253C15}\ = "IAudioCompress3"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F188A7D-9C9C-4646-8DEB-219E33C8637C}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3946800C-305F-4CF8-A3C3-8C4C4C283A1D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6F8DA9F-2696-419e-A8A3-19BE41EF51BD}\ToolboxBitmap32\ = "C:\\Program Files (x86)\\BearShare Applications\\BearShare\\GIFAnimator.dll, 1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C4C4F1F4-3074-4CB6-9FB8-0A64273166F0}\1.0\HELPDIR	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{14A400C3-0A2B-4D9D-B669-AAF465BB7C4F}\TypeLib\ = "{84B9B044-17C0-48FB-A300-C9747D5DF29C}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0734B07F-9F40-4A30-95F1-DC7C7B73A520}\TypeLib\ = "{43B4B831-F41F-4F73-8F14-4FFF0BA75B1B}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\938426F5D749AE64DB36DF48C7A16C1F\FWR1980	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3587106988-279496464-3440778474-1000_Classes\EPIHTML.7OIP4DTZMU6NMSBPJLZ273OVFE\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\EPISoftware\\EpiBrowser\\Application\\epibrowser.exe\" --single-argument %1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{31F8B21E-8674-4589-A37F-31A4D4B55CC5}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{34CB0620-E343-4772-BBA8-D3074BC47516}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{63A0F7FA-2C95-4d7e-AF25-EFCC303D20A1}\InprocServer32\ = "C:\\Program Files (x86)\\BearShare Applications\\BearShare\\Nickel.ocx"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\NCTAudioFormatSettings3.DLL\AppID = "{F7BCCFD4-2FA6-477D-A1B0-EF7500B3C49E}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83AC1413-FCE4-4A46-9DD5-4F31F306E71F}\Version\ = "1.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NCTAudioFile3.AudioFile3.1\CLSID\ = "{CD5175E2-7CC1-418C-B66C-0AB95DAD4103}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8F188A7D-9C9C-4646-8DEB-219E33C8637C}\ProxyStubClsid32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\938426F5D749AE64DB36DF48C7A16C1F\FCS1959	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.z\ = "WinRAR"	uninstall.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Aurigma.Thumbnail.5.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{98ED0D10-F1FC-4113-A095-9BD7F96040C9}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe

Modifies system certificate store 2 TTPs 20 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 0f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c0b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000006200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df8653000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c01400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b1d00000001000000100000005467b0adde8d858e30ee517b1a19ecd909000000010000000c000000300a06082b060105050703030300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b8200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 5c000000010000000400000000100000190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd10400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 5c000000010000000400000000080000190000000100000010000000fa46ce7cbb85cfb4310075313a09ee050300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d47e000000010000000800000000c001b39667d6011d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d341400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab0b000000010000001800000045006e00740072007500730074002e006e0065007400000062000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3397f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd940400000001000000100000004be2c99196650cf40e5a9392a00afeb22000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	WebCompanion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e260f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	Ninite WinRAR Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 0400000001000000100000004fdd07e4d42264391e0c3742ead1c6ae0300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd17e00000001000000080000000080c82b6886d7017a000000010000000c000000300a06082b060105050703091d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a07f0000000100000016000000301406082b0601050507030306082b060105050703096200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf690b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520036000000090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff1190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 190000000100000010000000d0fd3c9c380d7b65e26b9a3fedd39b8f030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba9531400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b0b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Ninite WinRAR Installer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4	WebCompanion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\4EFC31460C619ECAE59C1BCE2C008036D94C84B8\Blob = 1900000001000000100000005d1b8ff2c30f63f5b536edd400f7f9b40300000001000000140000004efc31460c619ecae59c1bce2c008036d94c84b809000000010000000c000000300a06082b060105050703031d00000001000000100000005467b0adde8d858e30ee517b1a19ecd91400000001000000140000001f00bf46800afc7839b7a5b443d95650bbce963b53000000010000001f000000301d301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000007b9d553e1c92cb6e8803e137f4f287d4363757f5d44b37d52f9fca22fb97df860b000000010000004200000047006c006f00620061006c005300690067006e00200043006f006400650020005300690067006e0069006e006700200052006f006f007400200052003400350000000f0000000100000030000000c130bba37b8b350e89fd5ed76b4f78777feee220d3b9e729042bef6af46e8e4c1b252e32b3080c681bc9a8a1afdd0a3c200000000100000076050000308205723082035aa00302010202107653feac75464893f5e5d74a483a4ef8300d06092a864886f70d01010c05003053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f7420523435301e170d3230303331383030303030305a170d3435303331383030303030305a3053310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613129302706035504031320476c6f62616c5369676e20436f6465205369676e696e6720526f6f742052343530820222300d06092a864886f70d01010105000382020f003082020a0282020100b62dc530dd7ae8ab903d0372b03a4b991661b2e5ffa5671d371ce57eec9383aa84f5a3439b98458ab863575d9b00880425e9f868924b82d84bc94a03f3a87f6a8f8a6127bda144d0fdf53f22c2a34f918db305b22882915dfb5988050b9706c298f82ca73324ee503a41ccf0a0b07b1d4dd2a8583896e9dff91b91bb8b102cd2c7431da20974a180af7be6330a0c596b8ebcf4ab5a977b7fae55fb84f080fe844cd7e2babdc475a16fbd61107444b29807e274abff68dc6c263ee91fe5e00487ad30d30c8d037c55b816705c24782025eb676788abba4e34986b7011de38cad4bea1c09ce1df1e0201d83be1674384b6cffc74b72f84a3bfba09373d676cb1455c1961ab4183f5ac1deb770d464773cebfbd9595ed9d2b8810fefa58e8a757e1b3cfa85ae907259b12c49e80723d93dc8c94df3b44e62680fcd2c303f08c0cd245d62ee78f989ee604ee426e677e42167162e704f960c664a1b69c81214e2bc66d689486c699747367317a91f2d48c796e7ca6bb7e466f4dc585122bcf9a224408a88537ce07615706171224c0c43173a1983557477e103a45d92da4519098a9a00737c4651aaa1c6b1677f7a797ec3f1930996f31fbea40b2e7d2c4fac9d0f050767459fa8d6d1732bef8e97e03f4e787759ad44a912c850313022b4280f2896a36cfc84ca0ce9ef8cb8dad16a7d3ded59b18a7c6923af18263f12e0e2464df0203010001a3423040300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e041604141f00bf46800afc7839b7a5b443d95650bbce963b300d06092a864886f70d01010c050003820201005e2bba749734445f764828408493ee016ee9a1b3d68025e67be4bc09913d0ffc76add7d43020bb8f60d091d61cf29cef781a2b943202c12496525202d0f3d1fcf29b396e99e11f8e43417d9a1e5bc95d9a84fc26e687f3747226ada41bd93d3b6a52a03c091e2f1e7bb333b445c7f7acb1af9360ad76aeb8b21578eb836aebffdb46ab24e5ee02fa901f59c02f5dd6b75da45c10b77253f8414eccfa781a254acafe85624361c3b437aa81d2f4d63a0fbd8d597e3047de2b6be72150335fd4679bd4b8679f3c279903ff85438e7312ca20cde861d5b166dc17d6396d0fdbcf2337a182894e1c6b3fd6a0cdaa079d3e4226aad70ceefa47bf1a527ed17581d3c98a62176d4f88a021a0263eaf6dd962301fe99828ae6e8dd58e4c726693808d2ae355c760679042565c22510fb3dc4e39ee4dddd91d7810543b6ed0976f03b51eb22373c612b29a64d0fc958524a8ffdfa1b0dc9140aedf0933abb9dd92b7f1cc91743b69eb67971b90bfe7c7a06f71bb57bfb78f5aed7a406a16cd80842d2fe102d4249443b315fc0c2b1bfd716ffccbbc75173a5e83d2c9b32f1bd59c8d7f54fe7e7ee456a387a79de1595294418f6d5bbe86959aff1a76dd40d2514a70b41f336323773fec271e59e40887ed34824a0f3ffea01dc1f56773458678f4aa29e92787c619dbc61314c33949874da097e06513f59d7756e9dab358c73af2c0cd82	cmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8CF427FD790C3AD166068DE81E57EFBB932272D4\Blob = 0400000001000000100000004be2c99196650cf40e5a9392a00afeb20f0000000100000020000000fde5f2d9ce2026e1e10064c0a468c9f355b90acf85baf5ce6f52d4016837fd94090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b0601050507030762000000010000002000000043df5774b03e7fef5fe40d931a7bedf1bb2e6b42738c4e6d3841103d3aa7f3390b000000010000001800000045006e00740072007500730074002e006e006500740000001400000001000000140000006a72267ad01eef7de73b6951d46c8d9f901266ab1d0000000100000010000000521b5f4582c1dcaae381b05e37ca2d347e000000010000000800000000c001b39667d6010300000001000000140000008cf427fd790c3ad166068de81e57efbb932272d4190000000100000010000000fa46ce7cbb85cfb4310075313a09ee052000000001000000420400003082043e30820326a00302010202044a538c28300d06092a864886f70d01010b05003081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d204732301e170d3039303730373137323535345a170d3330313230373137353535345a3081be310b300906035504061302555331163014060355040a130d456e74727573742c20496e632e31283026060355040b131f536565207777772e656e74727573742e6e65742f6c6567616c2d7465726d7331393037060355040b1330286329203230303920456e74727573742c20496e632e202d20666f7220617574686f72697a656420757365206f6e6c793132303006035504031329456e747275737420526f6f742043657274696669636174696f6e20417574686f72697479202d20473230820122300d06092a864886f70d01010105000382010f003082010a0282010100ba84b672db9e0c6be299e93001a776ea32b895411ac9da614e5872cffef68279bf7361060aa527d8b35fd3454e1c72d64e32f2728a0ff78319d06a808000451eb0c7e79abf1257271ca3682f0a87bd6a6b0e5e65f31c77d5d4858d7021b4b332e78ba2d5863902b1b8d247cee4c949c43ba7defb547d57bef0e86ec279b23a0b55e250981632135c2f7856c1c294b3f25ae4279a9f24d7c6ecd09b2582e3ccc2c445c58c977a066b2a119fa90a6e483b6fdbd4111942f78f07bff5535f9c3ef4172ce669ac4e324c6277eab7e8e5bb34bc198bae9c51e7b77eb553b13322e56dcf703c1afae29b67b683f48da5af624c4de058ac64341203f8b68d946324a4710203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604146a72267ad01eef7de73b6951d46c8d9f901266ab300d06092a864886f70d01010b05000382010100799f1d96c6b6793f228d87d3870304606a6b9a2e59897311ac43d1f513ff8d392bc0f2bd4f708ca92fea17c40b549ed41b9698333ca8ad62a20076ab59696e061d7ec4b9448d98af12d461db0a194647f3ebf763c1400540a5d2b7f4b59a36bfa98876880455042b9c877f1a373c7e2da51ad8d4895ecabdac3d6cd86dafd5f3760fcd3b8838229d6c939ac43dbf821b653fa60f5daafce5b215cab5adc6bc3dd084e8ea0672b04d393278bf3e119c0ba49d9a21f3f09b0b3078dbc1dc8743febc639acac5c21cc9c78dff3b125808e6b63dec7a2c4efb8396ce0c3c69875473a473c293ff5110ac155401d8fc05b189a17f74839a49d7dc4e7b8a486f8b45f6	WebCompanion.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\8094640EB5A7A1CA119C1FDDD59F810263A7FBD1\Blob = 190000000100000010000000cb9dd0fceaaa492f75ce292c21bbfbdd0f0000000100000030000000ea09c51d4c3a334ce4acd2bc08c6a9be352e334f45c4fccfcab63edb9f82dc87d4bd2ed2fadae11163fb954809984ff153000000010000007e000000307c301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301f06092b06010401a032010230123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000056000000305406082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d0020005200360000006200000001000000200000002cabeafe37d06ca22aba7391c0033d25982952c453647349763a3ab5ad6ccf697f0000000100000016000000301406082b0601050507030306082b06010505070309140000000100000014000000ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a01d0000000100000010000000521f5c98970d19a8e515ef6eeb6d48ef7a000000010000000c000000300a06082b060105050703097e00000001000000080000000080c82b6886d7010300000001000000140000008094640eb5a7a1ca119c1fddd59f810263a7fbd1200000000100000087050000308205833082036ba003020102020e45e6bb038333c3856548e6ff4551300d06092a864886f70d01010c0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3134313231303030303030305a170d3334313231303030303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523631133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820222300d06092a864886f70d01010105000382020f003082020a02820201009507e873ca66f9ec14ca7b3cf70d08f1b4450b2c82b448c6eb5b3cae83b841923314a46f7fe92accc6b0886bc5b689d1c6b2ff14ce511421ec4add1b5ac6d687ee4d3a1506ed64660b9280ca44de73944ef3a7897f4f786308c812506d42662f4db979284d521a8a1a80b719810e7ec48abc644c211c4368d73d3c8ac5b266d5909ab73106c5bee26d3206a61ef9b9ebaaa3b8bfbe826350d0f01889dfe40f79f5eaa21f2ad2702e7be7bc93bb6d53e2487c8c100738ff66b277617ee0ea8c3caab4a4f6f3954a12076dfd8cb289cfd0a06177c85874b0d4233af75d3acaa2db9d09de5d442d90f181cd5792fa7ebc50046334df6b9318be6b36b239e4ac2436b7f0efb61c135793b6deb2f8e285b773a2b835aa45f2e09d36a16f548af172566e2e88c55142441594eea3c538969b4e4e5a0b47f30636497730bc7137e5a6ec210875fce661163f77d5d99197840a6cd4024d74c014edfd39fb83f25e14a104b00be9feee8fe16e0bb208b36166096ab1063a659659c0f035fdc9da288d1a118770810aa89a751d9e3a8605009edb80d625f9dc059e27594c76395beaf9a5a1d8830fd1ffdf3011f985cf3348f5ca6d64142c7a584fd34b0849c595641a630e793df5b38cca58ad9c4245796e0e87195c54b165b6bf8c9bdc13e90d6fb82edc676ec98b11b584148a0019708379919791d41a27bf371e3207d814633c284caf0203010001a3633061300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0301f0603551d23041830168014ae6c05a39313e2a2e7e2d71cd6c7f07fc86753a0300d06092a864886f70d01010c050003820201008325ede8d1fd9552cd9ec004a09169e65cd084dedcada24fe84778d66598a95ba83c877c028ad16eb71673e65fc05498d574bec1cde21191ad23183ddde1724496b4955ec07b8e99781643135657b3a2b33bb577dc4072aca3eb9b353eb10821a1e7c443377932beb5e79c2c4cbc4329998e30d3ac21e0e31dfad80733765400222ab94d202e7068dae553fc835cd39df2ff440c4466f2d2e3bd46001a6d02ba255d8da13151dd54461c4ddb9996ef1a1c045ca615ef78e079fe5ddb3eaa4c55fd9a15a96fe1a6fbdf7030e9c3ee4246edc2930589fa7d637b3fd071817c00e898ae0e7834c325fbaf0a9f206bdd3b138f128ce2411a487a73a07769c7b65c7f82c81efe581b282ba86cad5e6dc005d27bb7eb80fe2537fe029b68ac425dc3eef5ccdcf05075d236699ce67b04df6e0669b6de0a09485987eb7b14607a64aa6943ef91c74cec18dd6cef532d8c99e15ef2723ecf54c8bd67eca40f4c45ffd3b93023074c8f10bf8696d9995ab499571ca4ccbb158953ba2c050fe4c49e19b11834d54c9dbaedf71faf24950478a803bbee81e5da5f7c8b4aa1907425a7b33e4bc82c56bdc7c8ef38e25c92f079f79c84ba742d6101207e7ed1f24f07595f8b2d4352eb460c94e1f566477977d5545b1fad2437cb455a4ea04448c8d8b099c5158409f6d64949c065b8e61a716ea0a8f182e8453e6cd602d70a6783055ac9a410	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D69B561148F01C77C54578C10926DF5B856976AD\Blob = 0f00000001000000200000005229ba15b31b0c6f4cca89c2985177974327d1b689a3b935a0bd975532af22ab090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520033000000620000000100000020000000cbb522d7b7f127ad6a0113865bdf1cd4102e7d0759af635a7cf4720dc963c53b1400000001000000140000008ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc1d000000010000001000000001728e1ecf7a9d86fb3cec8948aba953030000000100000014000000d69b561148f01c77c54578c10926df5b856976ad2000000001000000630300003082035f30820247a003020102020b04000000000121585308a2300d06092a864886f70d01010b0500304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e301e170d3039303331383130303030305a170d3239303331383130303030305a304c3120301e060355040b1317476c6f62616c5369676e20526f6f74204341202d20523331133011060355040a130a476c6f62616c5369676e311330110603550403130a476c6f62616c5369676e30820122300d06092a864886f70d01010105000382010f003082010a0282010100cc2576907906782216f5c083b684ca289efd057611c5ad8872fc460243c7b28a9d045f24cb2e4be1608246e152ab0c8147706cdd64d1ebf52ca30f823d0c2bae97d7b614861079bb3b1380778c08e149d26a622f1f5efa9668df892795389f06d73ec9cb26590d73deb0c8e9260e8315c6ef5b8bd20460ca49a628f6693bf6cbc82891e59d8a615737ac7414dc74e03aee722f2e9cfbd0bbbff53d00e10633e8822bae53a63a16738cdd410e203ac0b4a7a1e9b24f902e3260e957cbb904926868e538266075b29f77ff9114efae2049fcad401548d1023161195eb897efad77b7649a7abf5fc113ef9b62fb0d6ce0546916a903da6ee983937176c6698582170203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604148ff04b7fa82e4524ae4d50fa639a8bdee2dd1bbc300d06092a864886f70d01010b050003820101004b40dbc050aafec80ceff796544549bb96000941acb3138686280733ca6be674b9ba002daea40ad3f5f1f10f8abf73674a83c7447b78e0af6e6c6f03298e333945c38ee4b9576caafc1296ec53c62de4246cb99463fbdc536867563e83b8cf3521c3c968fecedac253aacc908ae9f05d468c95dd7a58281a2f1ddecd0037418fed446dd75328977ef367041e15d78a96b4d3de4c27a44c1b737376f41799c21f7a0ee32d08ad0a1c2cff3cab550e0f917e36ebc35749bee12e2d7c608bc3415113239dcef7326b9401a899e72c331f3a3b25d28640ce3b2c8678c9612f14baeedb556fdf84ee05094dbd28d872ced36250651eeb92978331d9b3b5ca47583f5f	Ninite WinRAR Installer.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254832000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd	cmd.exe

NTFS ADS 15 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Rar$DRa1636.14854.rartemp\Release\loader.exe:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\gopdfmanuals.msi:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\7z2201-x64.msi:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\btweb_installer.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Setup.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$DRa11120.23836.rartemp\install_all.bat:Zone.Identifier	WinRAR.exe
File opened for modification	C:\Users\Admin\Downloads\bearsharev9.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Visual-C-Runtimes-All-in-One-Nov-2024.zip:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\BearShare_setup.exe\:Zone.Identifier:$DATA	BearShare_V9_en_Setup.exe
File opened for modification	C:\Users\Admin\Downloads\KingzCheatsV1.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\memenite-master.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Release.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\Ninite WinRAR Installer.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\PDFMaker.exe:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\AppData\Local\Temp\Rar$EXa3364.11734.rartemp\Release\loader.exe:Zone.Identifier	WinRAR.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
7516	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
924	chrome.exe
3428	mapper.exe
3428	mapper.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
3680	maven.exe
3680	maven.exe
3652	mapper.exe
3652	mapper.exe
4640	Ninite.exe
4640	Ninite.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
6500	taskmgr.exe
3916	chrome.exe
3916	chrome.exe
1804	BearShare_V9_en_Setup.exe
1804	BearShare_V9_en_Setup.exe
1100	msiexec.exe
1100	msiexec.exe
9880	BearShare.exe
9880	BearShare.exe
9880	BearShare.exe
9880	BearShare.exe
3572	taskmgr.exe
3572	taskmgr.exe
3572	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
2292	7zFM.exe
4640	Ninite.exe
3364	WinRAR.exe
1636	WinRAR.exe
11120	WinRAR.exe
2360	notepad.exe
1952	epibrowser.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3428	mapper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2292	7zFM.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	2292	7zFM.exe
Token: 35	2292	7zFM.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe
Token: SeShutdownPrivilege	4652	chrome.exe
Token: SeCreatePagefilePrivilege	4652	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2292	7zFM.exe
2292	7zFM.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4560	taskmgr.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3652	mapper.exe
3264	uninstall.exe
2720	RarExtInstaller.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
4652	chrome.exe
2360	notepad.exe
2360	notepad.exe
9880	BearShare.exe
9880	BearShare.exe
9880	BearShare.exe
9880	BearShare.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4852	4652	chrome.exe	84
PID 4652 wrote to memory of 4852	4652	chrome.exe	84
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 3020	4652	chrome.exe	85
PID 4652 wrote to memory of 5092	4652	chrome.exe	86
PID 4652 wrote to memory of 5092	4652	chrome.exe	86
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87
PID 4652 wrote to memory of 4316	4652	chrome.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\FortniteCheatSRCUpdateEveryUpdate-master.zip"
1⤵
- Deletes itself
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2292

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f69acc40,0x7ff9f69acc4c,0x7ff9f69acc58
  2⤵
  PID:4852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1760 /prefetch:2
  2⤵
  PID:3020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  PID:5092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4444,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4448 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4904,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5000,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5100,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3512,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4364,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4580,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5356,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5380 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5608,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=5384,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4720,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3456,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5260,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5524,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3148,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=4368,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5676,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=4320,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=2700,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=3540,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=4992,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=4576,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5844,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=4536,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5900,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=5960,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=5860,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=5256,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6188,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=6000,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=4472,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=5880,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4476,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=5536,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=6268,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=6060,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5216,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6264,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4032,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:2864
- C:\Users\Admin\Downloads\Ninite WinRAR Installer.exe
  "C:\Users\Admin\Downloads\Ninite WinRAR Installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies system certificate store
  PID:1172
- - C:\Users\Admin\AppData\Local\Temp\110e32c5-d43f-11ef-a235-d67e284feecf\Ninite.exe
    Ninite.exe "69af395c6013fa41ae23449af0dae374874a8cf9" /fullpath "C:\Users\Admin\Downloads\Ninite WinRAR Installer.exe"
    3⤵
    - Executes dropped EXE
    - Drops desktop.ini file(s)
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\1294BD~1\target.exe
      "C:\Users\Admin\AppData\Local\Temp\1294BD~1\target.exe" /S
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      PID:1832
    - - C:\Program Files\WinRAR\uninstall.exe
        
        "C:\Program Files\WinRAR\uninstall.exe" /setup
        5⤵
        Executes dropped EXE
        Modifies system executable filetype association
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:3264
      - C:\Program Files\WinRAR\RarExtInstaller.exe
        
        "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=6236,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=5964,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5972,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=6084,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7012,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=4624,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=4900,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=7088,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=7140,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=7396,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=7804,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=5048,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=6132,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=7116,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:6856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=7764,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7800 /prefetch:1
  2⤵
  PID:7080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=6108,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=6944,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:7760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=5632,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:8040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=4468,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7408 /prefetch:1
  2⤵
  PID:8084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=6284,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:8308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=7444,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:8428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4784,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7500 /prefetch:8
  2⤵
  PID:8568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7056,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7496 /prefetch:8
  2⤵
  PID:8576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5128,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7620 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:8768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=7664,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:9052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=5916,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:9420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=5520,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:9436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=7248,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:9952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=5828,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=7692,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=7148,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:10424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4612,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7176 /prefetch:8
  2⤵
  PID:11080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7136,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7200 /prefetch:8
  2⤵
  PID:11088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5244,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7316 /prefetch:8
  2⤵
  PID:11096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6032,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:11104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6136,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:11112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6304,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:11268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --field-trial-handle=5272,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7052 /prefetch:1
  2⤵
  PID:11476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --field-trial-handle=6576,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:11712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7388,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=8080,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7992 /prefetch:8
  2⤵
  PID:868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --field-trial-handle=7384,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --field-trial-handle=6960,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7452 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --field-trial-handle=6908,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7232 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --field-trial-handle=5936,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --field-trial-handle=7800,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8036 /prefetch:1
  2⤵
  PID:6284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --field-trial-handle=7452,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8104 /prefetch:1
  2⤵
  PID:6364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --field-trial-handle=6444,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:6620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=94 --field-trial-handle=4548,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:6936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7004,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7184 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:7232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7252,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --field-trial-handle=5464,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:7096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --field-trial-handle=8004,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:6232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --field-trial-handle=6584,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7660 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --field-trial-handle=8020,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7176 /prefetch:1
  2⤵
  PID:7808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --field-trial-handle=3356,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:8392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=7312,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7940 /prefetch:8
  2⤵
  PID:8548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=6248,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6912 /prefetch:8
  2⤵
  PID:8556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7672,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7552 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:8916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --field-trial-handle=8364,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7956 /prefetch:1
  2⤵
  PID:9008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --field-trial-handle=4464,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8340 /prefetch:1
  2⤵
  PID:9276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --field-trial-handle=7376,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:9712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --field-trial-handle=7496,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4456 /prefetch:1
  2⤵
  PID:9744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --field-trial-handle=8636,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8612 /prefetch:1
  2⤵
  PID:10116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --field-trial-handle=5204,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:10244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=8640,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8680 /prefetch:8
  2⤵
  - NTFS ADS
  PID:10488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --field-trial-handle=7536,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:10672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --field-trial-handle=8400,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8480 /prefetch:1
  2⤵
  PID:11280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --field-trial-handle=8688,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8624 /prefetch:1
  2⤵
  PID:9636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --field-trial-handle=7888,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:12000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --field-trial-handle=7912,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8376 /prefetch:1
  2⤵
  PID:12096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --field-trial-handle=7704,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --field-trial-handle=8424,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --field-trial-handle=7640,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --field-trial-handle=7828,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8260 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --field-trial-handle=8272,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --field-trial-handle=5928,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8704 /prefetch:1
  2⤵
  PID:11480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --field-trial-handle=8748,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2248 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --field-trial-handle=8012,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9060 /prefetch:1
  2⤵
  PID:7520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --field-trial-handle=8500,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9148 /prefetch:1
  2⤵
  PID:7240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --field-trial-handle=8296,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:7184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --field-trial-handle=8732,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --field-trial-handle=3184,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7668 /prefetch:1
  2⤵
  PID:8628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=129 --field-trial-handle=7712,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:8724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5700,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:9100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6168,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:9108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5144,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:9332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8784,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8632 /prefetch:8
  2⤵
  PID:9380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=134 --field-trial-handle=5980,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8600 /prefetch:1
  2⤵
  PID:9700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=135 --field-trial-handle=8304,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8652 /prefetch:1
  2⤵
  PID:9212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=136 --field-trial-handle=5968,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:9992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=137 --field-trial-handle=7408,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:10092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=138 --field-trial-handle=7708,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7336 /prefetch:1
  2⤵
  PID:10128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=139 --field-trial-handle=6116,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8284 /prefetch:1
  2⤵
  PID:10284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=140 --field-trial-handle=6024,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:10828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=141 --field-trial-handle=8288,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2548 /prefetch:1
  2⤵
  PID:11136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=142 --field-trial-handle=5220,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:10688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=143 --field-trial-handle=7336,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9196 /prefetch:1
  2⤵
  PID:10084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=144 --field-trial-handle=8736,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:11700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=145 --field-trial-handle=9172,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9204 /prefetch:1
  2⤵
  PID:11836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=146 --field-trial-handle=8992,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:7476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=147 --field-trial-handle=8940,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9016 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=148 --field-trial-handle=8924,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=149 --field-trial-handle=9012,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8932 /prefetch:1
  2⤵
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=150 --field-trial-handle=5792,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9168 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=151 --field-trial-handle=8816,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=152 --field-trial-handle=8864,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7900 /prefetch:1
  2⤵
  PID:6504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=153 --field-trial-handle=8028,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8696 /prefetch:1
  2⤵
  PID:6556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=154 --field-trial-handle=5252,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:7872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=155 --field-trial-handle=4524,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8760 /prefetch:1
  2⤵
  PID:8264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=156 --field-trial-handle=7736,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:8984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=157 --field-trial-handle=9284,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9240 /prefetch:1
  2⤵
  PID:6236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=158 --field-trial-handle=9404,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8752 /prefetch:1
  2⤵
  PID:9128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=159 --field-trial-handle=8392,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9256 /prefetch:1
  2⤵
  PID:9384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=160 --field-trial-handle=5568,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:8428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=161 --field-trial-handle=9316,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9100 /prefetch:1
  2⤵
  PID:9840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=162 --field-trial-handle=8752,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9080 /prefetch:1
  2⤵
  PID:9872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=163 --field-trial-handle=8476,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9300 /prefetch:1
  2⤵
  PID:9172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=164 --field-trial-handle=8252,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:9836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=165 --field-trial-handle=7716,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7464 /prefetch:1
  2⤵
  PID:10208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=166 --field-trial-handle=9580,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9572 /prefetch:1
  2⤵
  PID:10596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=167 --field-trial-handle=10060,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=10092 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=168 --field-trial-handle=9044,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=10224 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=169 --field-trial-handle=10160,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=170 --field-trial-handle=8984,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=10104 /prefetch:1
  2⤵
  PID:6288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=171 --field-trial-handle=7228,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=10064 /prefetch:1
  2⤵
  PID:7652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=172 --field-trial-handle=10196,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8396 /prefetch:1
  2⤵
  PID:7892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=173 --field-trial-handle=9648,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=7512 /prefetch:1
  2⤵
  PID:9488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=174 --field-trial-handle=8312,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8996 /prefetch:1
  2⤵
  PID:8268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=175 --field-trial-handle=9568,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9676 /prefetch:1
  2⤵
  PID:7192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=176 --field-trial-handle=6272,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:8252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=177 --field-trial-handle=10092,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9224 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=178 --field-trial-handle=9388,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8960 /prefetch:1
  2⤵
  PID:9704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=179 --field-trial-handle=10024,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:9452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=180 --field-trial-handle=7464,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8804 /prefetch:1
  2⤵
  PID:7344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=181 --field-trial-handle=8828,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9384 /prefetch:1
  2⤵
  PID:10700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=182 --field-trial-handle=9464,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=8860 /prefetch:1
  2⤵
  PID:10072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=183 --field-trial-handle=9488,i,13513729268372308997,15066428725349691607,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=9480 /prefetch:1
  2⤵
  PID:11104

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2472

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4828

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:2332

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC
1⤵
PID:4416

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2372

C:\Users\Admin\Downloads\loader\loader.exe
"C:\Users\Admin\Downloads\loader\loader.exe"
1⤵
PID:4760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\memenite-master\Run me.bat" "
1⤵
- Enumerates connected drives
- Drops file in Windows directory
PID:1060
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\Downloads\memenite-master\Run me.bat""
  2⤵
  PID:2132
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\Downloads\memenite-master\Run me.bat"
    3⤵
    PID:1732
- C:\Users\Admin\Downloads\memenite-master\mapper.exe
  C:\Users\Admin\Downloads\memenite-master\mapper.exe spoofer.sys
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  PID:3428
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\Downloads\memenite-master\Run me.bat""
  2⤵
  PID:3908
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\Downloads\memenite-master\Run me.bat"
    3⤵
    PID:4616
- C:\Windows\system32\taskkill.exe
  taskkill /f /im epicgameslauncher.exe
  2⤵
  - Kills process with taskkill
  PID:744
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_EAC.exe
  2⤵
  - Kills process with taskkill
  PID:1568
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  PID:1764
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  PID:788
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteLauncher.exe
  2⤵
  - Kills process with taskkill
  PID:4928
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  PID:1100
- C:\Windows\system32\taskkill.exe
  taskkill /f /im FortniteClient-Win64-Shipping.exe
  2⤵
  - Kills process with taskkill
  PID:4900
- C:\Windows\system32\taskkill.exe
  taskkill /f /im EpicGamesLauncher.exe
  2⤵
  - Kills process with taskkill
  PID:4492
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
  2⤵
  PID:3972
- C:\Windows\system32\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Epic Games" /f
  2⤵
  PID:3656
- C:\Windows\system32\reg.exe
  reg delete "HKEY_LOCAL_MACHINE\Software\Epic Games" /f
  2⤵
  PID:4192

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\memenite-master\Run me.bat" "
1⤵
PID:3028
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c "findstr /b /c:":menu_" "C:\Users\Admin\Downloads\memenite-master\Run me.bat""
  2⤵
  PID:4468
- - C:\Windows\system32\findstr.exe
    findstr /b /c:":menu_" "C:\Users\Admin\Downloads\memenite-master\Run me.bat"
    3⤵
    PID:984
- C:\Windows\system32\taskkill.exe
  taskkill /IM EasyAntiCheat.exe
  2⤵
  - Kills process with taskkill
  PID:652
- C:\Windows\system32\net.exe
  net stop beservice
  2⤵
  PID:1636
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop beservice
    3⤵
    PID:3336
- C:\Windows\system32\taskkill.exe
  taskkill /IM FortniteClient-Win64-Shipping_BE.exe
  2⤵
  - Kills process with taskkill
  PID:336
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1316
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4512
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2696
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4908
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4256
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3384
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1596
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:460
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1532
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3396
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1640
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1264
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2732
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4900
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2056
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2808
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1512
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1052
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3824
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1400
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:540
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3972
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1204
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:712
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3176
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2064
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3340
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:244
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2216
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1856
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2268
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2956
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:5108
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2464
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4988
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1048
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4552
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3652
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:576
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:868
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3400
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3548
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3788
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4628
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4616
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2928
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1556
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3488
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1764
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2500
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1972
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1464
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5080
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4476
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1948
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4492
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1628
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:932
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3208
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4048
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1376
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3992
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3160
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:720
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4588
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4960
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1980
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1472
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:660
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3916
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4796
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2080
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3404
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4684
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4924
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1600
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2852
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1420
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4988
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1984
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4552
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4468
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4604
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3440
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3400
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:652
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:388
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3428
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4908
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4616
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1556
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1972
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1464
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2276
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1668
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2972
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3124
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:932
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1512
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2488
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2572
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1952
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2588
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4156
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4480
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4416
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3016
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3040
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1932
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:244
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3604
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3120
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2216
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2956
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3640
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4560
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1420
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3680
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2284
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4200
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2676
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2612
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2160
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3440
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3400
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:652
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2788
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3428
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4908
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4616
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4600
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1972
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4064
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2732
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2924
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5008
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2972
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4048
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1456
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1376
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4192
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4216
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3136
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4772
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4080
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1980
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3040
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4596
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3340
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4220
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1856
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4920
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2268
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:5108
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2944
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1048
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4720
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3652
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4956
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3804
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4516
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1732
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2160
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2448
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3788
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3024
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1388
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1944
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:460
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1264
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:5080
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3320
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1948
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2732
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1668
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3656
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3124
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4556
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4424
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4708
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4192
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2024
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3136
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3916
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1752
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5112
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1932
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4684
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3604
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3700
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2216
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2852
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2956
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:984
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4560
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3164
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1984
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3004
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4200
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3548
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1812
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1860
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2672
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3908
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4628
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4496
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3488
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1100
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2636
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1380
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1524
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3376
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4312
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2272
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4356
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4048
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2156
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5088
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:5008
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4960
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2488
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1060
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1396
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3016
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4236
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4416
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1580
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3044
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1300
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4924
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4220
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4832
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4176
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2856
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4860
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1540
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4560
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4404
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1984
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1080
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4200
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3804
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1812
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2016
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2672
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:744
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4628
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3024
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3488
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:240
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2636
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4900
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1524
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2276
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4312
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1052
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4356
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2572
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2156
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3520
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5008
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4424
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2488
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1392
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1396
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1788
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4236
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1228
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1580
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1932
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1300
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3604
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4220
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2216
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4176
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2268
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2856
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4936
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1540
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3512
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4404
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:868
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1080
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3348
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3804
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1308
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2016
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3400
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:744
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3428
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3024
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1464
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:240
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:600
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4900
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1972
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2276
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2732
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1052
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3992
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2572
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1376
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3520
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4156
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1204
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1392
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3724
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1788
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4820
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1228
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2008
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1932
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1700
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3604
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4752
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2216
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1872
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2268
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:344
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4936
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4720
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3512
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:792
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:868
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4516
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2160
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:388
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:684
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2448
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4008
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2788
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3428
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4908
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1464
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:5080
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:600
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3320
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1972
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1668
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2732
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:712
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4588
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1376
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4556
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4156
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4772
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1204
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4480
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3724
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1788
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4820
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2080
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2008
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1932
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1700
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3604
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4752
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2216
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1872
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2268
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:344
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4720
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3004
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:792
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3348
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4200
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3804
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2160
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3524
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:652
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1388
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:568
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1556
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1944
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1264
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5080
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3208
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3320
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2924
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1668
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3992
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3824
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1052
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2484
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1652
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4424
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4764
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3476
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1112
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4416
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1752
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:660
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4596
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1460
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3340
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4920
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3120
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4740
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4728
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2944
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1872
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2284
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:344
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:464
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4720
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3004
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1636
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3348
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1308
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3804
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2672
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3524
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1724
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1388
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2128
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1556
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1380
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1264
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4064
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3208
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2272
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2924
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3824
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1052
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4960
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:1652
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:3520
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1980
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4192
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4912
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3016
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4624
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1580
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4596
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1460
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1300
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1932
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4940
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3896
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4832
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:5108
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:3640
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:1048
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1540
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:344
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:336
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:332
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2696
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1732
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:5096
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3400
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3396
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:872
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:744
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4616
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:3488
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4908
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4492
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:4900
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:5080
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2280
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2808
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  - Enumerates processes with tasklist
  PID:2156
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2572
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:904
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2484
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1000
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:1060
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:4556
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:2024
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:3916
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:4796
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:1228
- C:\Windows\system32\findstr.exe
  FINDSTR /I "BEservice.exe"
  2⤵
  PID:4820
- C:\Windows\system32\tasklist.exe
  TASKLIST
  2⤵
  PID:2008
- C:\Windows\system32\findstr.exe
  FINDSTR /I "EasyAntiCheat.exe"
  2⤵
  PID:2464

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\memenite-master\Run me.bat
1⤵
PID:1764

C:\Users\Admin\Downloads\memenite-master\maven.exe
"C:\Users\Admin\Downloads\memenite-master\maven.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680

C:\Users\Admin\Downloads\memenite-master\mapper.exe
"C:\Users\Admin\Downloads\memenite-master\mapper.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3652

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Release.rar"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
PID:3364
- C:\Program Files\WinRAR\RarExtInstaller.exe
  "C:\Program Files\WinRAR\RarExtInstaller.exe" -install
  2⤵
  - Executes dropped EXE
  PID:3964

C:\Program Files\WinRAR\WinRAR.exe
"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Release.rar"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: GetForegroundWindowSpam
PID:1636

C:\Users\Admin\Downloads\Release\loader.exe
"C:\Users\Admin\Downloads\Release\loader.exe"
1⤵
- Executes dropped EXE
PID:1112
- C:\Users\Admin\Downloads\Release\loader.exe
  "C:\Users\Admin\Downloads\Release\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  PID:3748
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Windows\System32\SyncInfrastructure.exe"
    3⤵
    PID:1348
  - - C:\Windows\System32\SyncInfrastructure.exe
      C:\Windows\System32\SyncInfrastructure.exe
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:1344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004EC
1⤵
PID:11488

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:6500

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\wow.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:7516

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Blocklisted process makes network request
- Modifies system certificate store
PID:5696
- C:\Windows\system32\notepad.exe
  notepad
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2360
- - C:\Windows\system32\notepad.exe
    "C:\Windows\system32\notepad.exe"
    3⤵
    PID:11308
- C:\Users\Admin\Desktop\stuff\1.exe
  C:\Users\Admin\Desktop\stuff\1.exe /passive /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1340
- - C:\Users\Admin\AppData\Local\Temp\miaCCCF.tmp\BearShare_V9_en_Setup.exe
    .\BearShare_V9_en_Setup.exe /passive /norestart /m="C:\Users\Admin\Desktop\stuff\1.exe" /k=""
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - NTFS ADS
    - Suspicious behavior: EnumeratesProcesses
    PID:1804
  - - C:\Windows\SysWOW64\regsvr32.exe
      "regsvr32" /s "C:\Program Files (x86)\BearShare Applications\BearShare\WMHelper.dll"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:10088
  - - C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe
      "C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      PID:9880
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\BearShare Applications\BearShare\Copy_Folder.bat" BearShare C:\PROGRA~3\BEARSH~1\ C:\Users\Admin\AppData\Local\BEARSH~1\
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10356
      - C:\Windows\SysWOW64\xcopy.exe
        
        XCOPY "C:\PROGRA~3\BEARSH~1\*.*" C:\Users\Admin\AppData\Local\BEARSH~1\ /E /S /H /Y
        6⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:5324
      - C:\Windows\SysWOW64\xcopy.exe
        
        XCOPY "C:\PROGRA~3\BEARSH~1\player.swf" C:\Users\Admin\AppData\Local\BEARSH~1\ /E /S /H /Y
        6⤵
        System Location Discovery: System Language Discovery
        Enumerates system info in registry
        
        PID:9528
  - - C:\Windows\SysWOW64\netsh.exe
      netsh.exe firewall add allowedprogram program = "C:\Program Files (x86)\BearShare Applications\BearShare\BearShare.exe" name = "BearShare" scope = ALL profile = ALL
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      System Location Discovery: System Language Discovery
      PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\SetupDataMngr_BearShare.exe
      "C:\Users\Admin\AppData\Local\Temp\SetupDataMngr_BearShare.exe" /S
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:8508
    - - C:\Users\Admin\AppData\Local\Temp\nsb44FF.tmp.exe
        
        "C:\Users\Admin\AppData\Local\Temp\nsb44FF.tmp.exe" /S
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Drops file in System32 directory
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies Internet Explorer start page
        
        PID:5144
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" C:\Users\Admin\AppData\Local\Temp\INSTAL~1.DLL,_SetFFAssets http://search.bearshare.com/,BearShare Web Search,WebSearch,http://search.bearshare.com/web?src=ffb&q=,
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7548
      - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\System32\regsvr32.exe" /s /u "C:\Program Files (x86)\BearShare Applications\MediaBar\DataMngr\IEBHO.dll"
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\BEARSH~2.EXE
        
        "C:\Users\Admin\AppData\Local\Temp\BEARSH~2.EXE" /S /NOADDREMOVE /D=C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar
        6⤵
        Executes dropped EXE
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        
        PID:7704
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /u /s "C:\Program Files (x86)\BearShareTb\BearShareDx.dll"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /u /s "C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll"
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5928
        
        C:\Windows\SysWOW64\regsvr32.exe
        
        regsvr32 /s "C:\Program Files (x86)\BearShare Applications\MediaBar\ToolBar\BearshareMediabarDx.dll"
        7⤵
        Installs/modifies Browser Helper Object
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\GLJ4685.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\GLJ4685.tmp" C:\Program Files (x86)\BearShare Applications\MediaBar\DataMngr\IEBHO.dll
        6⤵
        Executes dropped EXE
        Installs/modifies Browser Helper Object
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5460
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\stuff\3.msi" /passive /norestart
  2⤵
  PID:8748
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Desktop\stuff\4.msi" /passive /norestart
  2⤵
  PID:10724
- C:\Users\Admin\Desktop\stuff\5.exe
  C:\Users\Admin\Desktop\stuff\5.exe /passive /norestart
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  PID:11412
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\PDFMaker\PDFMaker 1.0.0\install\3156620\PDFMaker.msi" /passive /norestart AI_SETUPEXEPATH=C:\Users\Admin\Desktop\stuff\5.exe SETUPEXEDIR=C:\Users\Admin\Desktop\stuff\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1736813956 /passive /norestart "
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5808
- C:\Users\Admin\Desktop\stuff\6.exe
  C:\Users\Admin\Desktop\stuff\6.exe /passive /norestart
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:10560
- - C:\Users\Admin\AppData\Local\Temp\7zS04927765\WebCompanion-Installer.exe
    .\WebCompanion-Installer.exe --savename=Setup.exe --partner=IN230901 --nonadmin --direct --tych --campaign=18264794070 --version=13.901.1.1179 /passive /norestart
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5008
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C netsh http add urlacl url=http://+:9007/ user=Everyone
      4⤵
      System Location Discovery: System Language Discovery
      PID:8552
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh http add urlacl url=http://+:9007/ user=Everyone
        5⤵
        Event Triggered Execution: Netsh Helper DLL
        System Location Discovery: System Language Discovery
        
        PID:2248
  - - C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
      "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --install --geo=
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:9536
  - - C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe
      "C:\Users\Admin\AppData\Roaming\Lavasoft\Web Companion\Application\WebCompanion.exe" --afterinstall
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies system certificate store
      PID:10264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://webcompanion.com/en/install.php?partner=IN230901&campaign=18264794070&
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      PID:9344
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f69acc40,0x7ff9f69acc4c,0x7ff9f69acc58
        5⤵
        
        PID:10424
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2264,i,7386415218709721508,13973911651673944713,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2268 /prefetch:2
        5⤵
        
        PID:11460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1812,i,7386415218709721508,13973911651673944713,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2520 /prefetch:3
        5⤵
        
        PID:9648
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1752,i,7386415218709721508,13973911651673944713,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2600 /prefetch:8
        5⤵
        
        PID:10076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,7386415218709721508,13973911651673944713,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:5728
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,7386415218709721508,13973911651673944713,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3296 /prefetch:1
        5⤵
        
        PID:6364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4480,i,7386415218709721508,13973911651673944713,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4488 /prefetch:1
        5⤵
        
        PID:8764

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:3916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f69acc40,0x7ff9f69acc4c,0x7ff9f69acc58
  2⤵
  PID:3488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1752,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=1688 /prefetch:2
  2⤵
  PID:6092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1932,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2096 /prefetch:3
  2⤵
  PID:8640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2184,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2200 /prefetch:8
  2⤵
  PID:10652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:8044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:8160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3576,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4124 /prefetch:2
  2⤵
  PID:8944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3976,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:8128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3760,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:8000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5092,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5272,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:11856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5344,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5636,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:10616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4220,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:7444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5680,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:10656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4352,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:8596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5936,i,13346226607418619359,14678145955256556188,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4600 /prefetch:8
  2⤵
  - NTFS ADS
  PID:10964
- C:\Program Files\WinRAR\WinRAR.exe
  "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\Admin\Downloads\Visual-C-Runtimes-All-in-One-Nov-2024.zip"
  2⤵
  - Executes dropped EXE
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  PID:11120

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:11512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:9132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7816

C:\Windows\System32\DataExchangeHost.exe
C:\Windows\System32\DataExchangeHost.exe -Embedding
1⤵
PID:10228

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1100
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 27D78493146832F2740D18F0A2CF73E5
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6120
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\GIFAnimator.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2448
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\DiscoveryHelper.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:9024
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\IMTrProgress.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7756
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\IMWebControl.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:4776
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\Nickel.ocx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:3952
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\ImageUploader5.ocx"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:1424
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioCDGrabber2.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:492
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioCDWriter2.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:7436
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioCompress3.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:11496
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioFile3.dll"
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7688
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioFileWMA3.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:2156
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTAudioFormatSettings3.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:11404
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\BearShare Applications\BearShare\NCTDataCDWriter2.dll"
  2⤵
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  PID:7152
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:9884
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A65EB7981121F9C732CE7336634BB8F3
  2⤵
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:5204
- C:\Windows\Installer\MSID4D7.tmp
  "C:\Windows\Installer\MSID4D7.tmp" /HideWindow "C:\Users\Admin\AppData\Local\EPISoftware\\installer.exe"
  2⤵
  - Executes dropped EXE
  PID:3612
- C:\Windows\Installer\MSI4E8C.tmp
  "C:\Windows\Installer\MSI4E8C.tmp" /HideWindow /dir "C:\Users\Admin\AppData\Local\EPISoftware\" CMD.EXE /C "DEL installer.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:10024
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding AA8AD94FB0E3AE44AC7182028C6EEDE9 C
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10368
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2A60F8CE2F2B5131F95129171843408
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    -NoProfile -Noninteractive -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\pss6601.ps1" -propFile "C:\Users\Admin\AppData\Local\Temp\msi65EE.txt" -scriptFile "C:\Users\Admin\AppData\Local\Temp\scr65EF.ps1" -scriptArgsFile "C:\Users\Admin\AppData\Local\Temp\scr65F0.txt" -propSep " :<->: " -lineSep " <<:>> " -testPrefix "_testValue."
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    PID:6216
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI76A3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_243627656 4394 RequestSender!RequestSender.CustomActions.Finish
    3⤵
    - Blocklisted process makes network request
    - System Location Discovery: System Language Discovery
    PID:6540

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:3572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5672

C:\Users\Admin\AppData\Local\EPISoftware\installer.exe
"C:\Users\Admin\AppData\Local\EPISoftware\installer.exe"
1⤵
- Executes dropped EXE
PID:3596
- C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe
  "C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe" --install-archive="C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\EPIBROWSER.PACKED.7Z"
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:920
- - C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe
    C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=EpiBrowser --annotation=ver=130.0.6723.147 --initial-client-data=0x2a8,0x2ac,0x2b0,0x284,0x2b4,0x7ff648cac158,0x7ff648cac164,0x7ff648cac170
    3⤵
    - Executes dropped EXE
    PID:9136
- - C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe
    "C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe" --verbose-logging --create-shortcuts=0 --install-level=0
    3⤵
    - Executes dropped EXE
    PID:5704
  - - C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe
      C:\Users\Admin\AppData\Local\EPISoftware\CR_249BB.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=EpiBrowser --annotation=ver=130.0.6723.147 --initial-client-data=0x2c0,0x2c4,0x2c8,0x29c,0x2cc,0x7ff648cac158,0x7ff648cac164,0x7ff648cac170
      4⤵
      Executes dropped EXE
      PID:2064
- - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
    "C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe" --from-installer --no-startup-window
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Checks system information in the registry
    - Enumerates system info in registry
    - Suspicious behavior: GetForegroundWindowSpam
    PID:1952
  - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
      C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data" /prefetch:4 --monitor-self --monitor-self-argument=--type=crashpad-handler "--monitor-self-argument=--user-data-dir=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data" --monitor-self-argument=/prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=EpiBrowser --annotation=ver=130.0.6723.147 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa05347c38,0x7ffa05347c44,0x7ffa05347c50
      4⤵
      Executes dropped EXE
      PID:6500
    - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
        
        C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data" /prefetch:4 --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\User Data\Crashpad" --annotation=plat=Win64 --annotation=prod=EpiBrowser --annotation=ver=130.0.6723.147 --initial-client-data=0x188,0x18c,0x190,0x140,0x194,0x7ff7cdfe4d58,0x7ff7cdfe4d64,0x7ff7cdfe4d70
        5⤵
        Executes dropped EXE
        
        PID:6740
  - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
      "C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2096,i,6089301061625832769,1000591774763650092,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:5236
  - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
      "C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --start-stack-profiler --field-trial-handle=1720,i,6089301061625832769,1000591774763650092,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:11
      4⤵
      Executes dropped EXE
      PID:6872
  - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
      "C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --field-trial-handle=2400,i,6089301061625832769,1000591774763650092,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
      4⤵
      Executes dropped EXE
      PID:6040
  - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
      "C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3708,i,6089301061625832769,1000591774763650092,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:11876
  - - C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe
      "C:\Users\Admin\AppData\Local\EPISoftware\EpiBrowser\Application\epibrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations=is-enterprise-managed=no --field-trial-handle=3800,i,6089301061625832769,1000591774763650092,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:14
      4⤵
      Executes dropped EXE
      PID:2316
- C:\Windows\System32\cmd.exe
  C:\Windows\System32\cmd.exe /c ""C:\Program Files\Google\Chrome\Application\chrome.exe" https://pdf.epibrowser.com/en/pdfeditor"
  2⤵
  PID:6924
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" https://pdf.epibrowser.com/en/pdfeditor
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    PID:6792
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ff9f69acc40,0x7ff9f69acc4c,0x7ff9f69acc58
      4⤵
      PID:7008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1720,i,10705446844002746872,3265297813809881096,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      PID:5024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2064,i,10705446844002746872,3265297813809881096,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2116 /prefetch:3
      4⤵
      PID:4780
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,10705446844002746872,3265297813809881096,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2504 /prefetch:8
      4⤵
      PID:4572
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,10705446844002746872,3265297813809881096,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3128 /prefetch:1
      4⤵
      PID:5276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,10705446844002746872,3265297813809881096,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:7060
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4632,i,10705446844002746872,3265297813809881096,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4660 /prefetch:8
      4⤵
      PID:11552

C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe" -Embedding
1⤵
PID:11904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x1fc,0x200,0x204,0x1d8,0x208,0x7ff60b0a3600,0x7ff60b0a360c,0x7ff60b0a3618
  2⤵
  PID:6096

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:9552

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /C "DEL installer.exe"
1⤵
PID:11316

C:\Users\Admin\AppData\Roaming\PDFMaker\upd.exe
C:\Users\Admin\AppData\Roaming\PDFMaker\upd.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:8752
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\\handler.ps1"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  PID:11284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
PID:11612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9f7183cb8,0x7ff9f7183cc8,0x7ff9f7183cd8
  2⤵
  PID:10660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:9112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  PID:11824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2512 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:6900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4572 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4564 /prefetch:1
  2⤵
  PID:7216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:8952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:11932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:6368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:11268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3960 /prefetch:1
  2⤵
  PID:6204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:8868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,11431859739590007444,1511929993084078873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:10324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9960

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:7204

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:11200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f69acc40,0x7ff9f69acc4c,0x7ff9f69acc58
  2⤵
  PID:7088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:6228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  PID:4616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:8792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4240,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4700,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=4712 /prefetch:8
  2⤵
  PID:9152
- C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:8936
- - C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x258,0x25c,0x260,0x234,0x264,0x7ff644e24698,0x7ff644e246a4,0x7ff644e246b0
    3⤵
    PID:8980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=4988,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5020,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:11616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5036,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:11444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5060,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:7824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5572,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:7208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3436,i,2478498337191230262,1858851303018201094,262144 --variations-seed-version=20250114-180129.242000 --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:6520

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:2272

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery