quasar | hxxp://tinyurl[.]com/4ypskr89

pid	Process
9304	chrome.exe
8648	chrome.exe
7820	chrome.exe
10512	chrome.exe

Executes dropped EXE 19 IoCs

pid	Process
1100	burpsuite2.4.EXE
1228	BURPSU~1.EXE
7308	svhostt.exe
6200	BURPSU~2.EXE
1008	java.exe
10128	BURPSU~2.EXE
7592	BurpSuiteCommunity.exe
9116	java.exe
8360	bgupdater.exe
9304	chrome.exe
7316	chrome.exe
7952	chrome.exe
2284	chrome.exe
7920	chrome.exe
7820	chrome.exe
8648	chrome.exe
10512	chrome.exe
7940	chrome.exe
10372	chrome.exe

Loads dropped DLL 64 IoCs

pid	Process
1008	java.exe
1008	java.exe
1008	java.exe
1008	java.exe
1008	java.exe
1008	java.exe
1008	java.exe
1008	java.exe
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
9116	java.exe
9116	java.exe
9116	java.exe
9116	java.exe
9116	java.exe
9116	java.exe
9116	java.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe
8360	bgupdater.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	burpsuite2.4.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
175	ip-api.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
162	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	996	firefox.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	chrome.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.crypto.cryptoki\i4j16630806779299018638.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\.install4j\i4j_extf_2_1ov2nc9_s10jxd.png	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j11195887896386889663.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\conf\i4j16958770725245762917.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\conf\security\policy\limited\exempt_local.policy	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.logging\i4j1503403785435657275.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.sql.rowset\i4j8724248959364423119.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\conf\i4j16063452665017375281.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.crypto.mscapi\LICENSE	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\.install4j\i4j5417468493856543678.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\d3dcompiler_47.dll	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\vcruntime140_1.dll	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.desktop\colorimaging.md	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.xml.crypto\ASSEMBLY_EXCEPTION	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\.install4j\i4j10810021678606887760.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.instrument\i4j5502652970591434138.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\ja.pak.info	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\conf\security\policy\limited\i4j17582783279822098655.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\burpsuite_community.jar	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\.install4j\i4jruntime.jar	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\it.pak	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\.install4j\response.varfile	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\management.dll	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.xml\i4j2417084187868209672.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\lib\security\cacerts	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j8284873564742302003.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.base\public_suffix.md	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.crypto.mscapi\ADDITIONAL_LICENSE_INFO	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\.install4j\i4j5078233670470434260.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\.install4j\i4j1241279507232169254.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.security.jgss\LICENSE	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.logging\i4j6266013190958637285.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.prefs\LICENSE	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.security.sasl\LICENSE	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\.install4j\i4j2442148093563142861.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j10248169502512750497.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j8093685849370248962.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\jsound.dll	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j9935322817249654516.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.compiler\i4j8251052627479347823.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\ru.pak	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j6070130583617492637.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.unsupported\i4j12415480237289189366.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\.install4j\i4jdel.exe	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\am.pak.info	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\es-419.pak	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j10162426693535281653.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\.install4j\i4j13667876975000072013.tmp	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\es.pak	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\.install4j\response.varfile	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\Locales\bn.pak.info	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\bin\i4j2842819380692870985.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\include\win32\i4j13094552131402145947.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.base\zlib.md	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.management.rmi\i4j10419515820424866180.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.security.sasl\ASSEMBLY_EXCEPTION	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\lib\i4j8568334137658120523.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\zip.dll	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\include\win32\bridge\i4j17917974194633780233.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.net.http\i4j3501369817266207715.tmp	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\java.security.sasl\ADDITIONAL_LICENSE_INFO	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\legal\jdk.zipfs\ASSEMBLY_EXCEPTION	BURPSU~2.EXE
File opened for modification	C:\Program Files\BurpSuiteCommunity\jre\bin\api-ms-win-core-console-l1-1-0.dll	BURPSU~2.EXE
File created	C:\Program Files\BurpSuiteCommunity\jre\legal\java.se\i4j14392846736605631001.tmp	BURPSU~2.EXE

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svhostt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BURPSU~1.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
7492	PING.EXE

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BURPSU~2.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	BurpSuiteCommunity.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	bgupdater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	BURPSU~2.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	BurpSuiteCommunity.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	bgupdater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	java.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

defense_evasion spyware trojan

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133834108121032234"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	BackgroundTransferHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\DefaultIcon	BURPSU~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\DefaultIcon\ = "C:\\Program Files\\BurpSuiteCommunity\\.install4j\\i4j_extf_8_1ov2nc9_xvjhy2.ico"	BURPSU~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	BurpSuiteCommunity.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache	BackgroundTransferHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\shell	BURPSU~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\shell\open	BURPSU~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\shell\open\command	BURPSU~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\shell\open\command\ = "\"C:\\Program Files\\BurpSuiteCommunity\\BurpSuiteCommunity.exe\" \"%1\""	BURPSU~2.EXE
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	BurpSuiteCommunity.exe
Key created	\REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.burp	BURPSU~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.burp\ = "BurpSuiteCommunity"	BURPSU~2.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity	BURPSU~2.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BurpSuiteCommunity\ = "Burp Suite Project File"	BURPSU~2.EXE

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C	chrome.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0400000001000000100000003e455215095192e1b75d379fb187298a0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b06010505070308530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c99140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b9992367f000000010000000c000000300a06082b060105050703097a000000010000000c000000300a06082b060105050703097e00000001000000080000000000042beb77d501030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c190000000100000010000000a823b4a20180beb460cab955c24d7e21200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	chrome.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 5c000000010000000400000000080000190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c7e00000001000000080000000000042beb77d5017a000000010000000c000000300a06082b060105050703097f000000010000000c000000300a06082b060105050703091d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b620000000100000020000000ebd41040e4bb3ec742c9e381d31ef2a41a48b6685c96e7cef3c1df6cd4331c990b000000010000003000000047006c006f00620061006c005300690067006e00200052006f006f00740020004300410020002d002000520031000000530000000100000040000000303e301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050508020206082b0601050507030606082b0601050507030706082b0601050507030906082b0601050507030106082b060105050703080f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d0400000001000000100000003e455215095192e1b75d379fb187298a200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0	chrome.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Packburpsuite24.rar:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
7492	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1088	schtasks.exe
5116	schtasks.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
9304	chrome.exe
9304	chrome.exe
7940	chrome.exe
7940	chrome.exe
10372	chrome.exe
10372	chrome.exe
4940	chrome.exe
4940	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
2012	chrome.exe
11092	msedge.exe
11092	msedge.exe
8244	msedge.exe
8244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
9304	chrome.exe
9304	chrome.exe
9304	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
4940	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	firefox.exe
Token: SeDebugPrivilege	996	firefox.exe
Token: 33	6172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6172	AUDIODG.EXE
Token: SeDebugPrivilege	996	firefox.exe
Token: SeRestorePrivilege	7584	7zG.exe
Token: 35	7584	7zG.exe
Token: SeSecurityPrivilege	7584	7zG.exe
Token: SeSecurityPrivilege	7584	7zG.exe
Token: SeRestorePrivilege	7756	7zG.exe
Token: 35	7756	7zG.exe
Token: SeSecurityPrivilege	7756	7zG.exe
Token: SeSecurityPrivilege	7756	7zG.exe
Token: SeDebugPrivilege	996	firefox.exe
Token: SeDebugPrivilege	996	firefox.exe
Token: SeDebugPrivilege	996	firefox.exe
Token: SeRestorePrivilege	680	7zG.exe
Token: 35	680	7zG.exe
Token: SeSecurityPrivilege	680	7zG.exe
Token: SeSecurityPrivilege	680	7zG.exe
Token: SeDebugPrivilege	1228	BURPSU~1.EXE
Token: SeDebugPrivilege	7308	svhostt.exe
Token: SeDebugPrivilege	6200	BURPSU~2.EXE
Token: SeBackupPrivilege	6200	BURPSU~2.EXE
Token: SeDebugPrivilege	996	firefox.exe
Token: SeDebugPrivilege	996	firefox.exe
Token: SeDebugPrivilege	996	firefox.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe
Token: SeCreatePagefilePrivilege	4940	chrome.exe
Token: SeShutdownPrivilege	4940	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
7584	7zG.exe
7756	7zG.exe
680	7zG.exe
6200	BURPSU~2.EXE
7592	BurpSuiteCommunity.exe
9304	chrome.exe
9304	chrome.exe
9304	chrome.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
7592	BurpSuiteCommunity.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
4940	chrome.exe
996	firefox.exe
996	firefox.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe
8244	msedge.exe

Suspicious use of SetWindowsHookEx 26 IoCs

pid	Process
996	firefox.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
7676	OpenWith.exe
7676	OpenWith.exe
7676	OpenWith.exe
7676	OpenWith.exe
7676	OpenWith.exe
7308	svhostt.exe
6200	BURPSU~2.EXE
6200	BURPSU~2.EXE
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
8360	bgupdater.exe
996	firefox.exe
996	firefox.exe
996	firefox.exe
3724	MiniSearchHost.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe
7592	BurpSuiteCommunity.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 3220 wrote to memory of 996	3220	firefox.exe	77
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 3532	996	firefox.exe	78
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79
PID 996 wrote to memory of 1080	996	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://tinyurl.com/4ypskr89"
1⤵
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://tinyurl.com/4ypskr89
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae3db3c8-3e72-4ca9-a3ee-15b97fb65504} 996 "\\.\pipe\gecko-crash-server-pipe.996" gpu
    3⤵
    PID:3532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {11ce5114-72e8-4b42-90db-36565eaa306f} 996 "\\.\pipe\gecko-crash-server-pipe.996" socket
    3⤵
    PID:1080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2664 -childID 1 -isForBrowser -prefsHandle 2860 -prefMapHandle 2996 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fdb25307-b174-492e-9bee-fcf75f8bc7ea} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3776 -childID 2 -isForBrowser -prefsHandle 3768 -prefMapHandle 3788 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93ed396f-fb21-420f-ab05-7add6533c40d} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:2160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4680 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4752 -prefMapHandle 4724 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d75e0c4-5f7c-4dec-ac23-28a1e7ddf987} 996 "\\.\pipe\gecko-crash-server-pipe.996" utility
    3⤵
    - Checks processor information in registry
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5184 -childID 3 -isForBrowser -prefsHandle 5216 -prefMapHandle 5212 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ad5fd0f-29e8-444a-a21f-50c9d10cb7a2} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:4472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5492 -childID 4 -isForBrowser -prefsHandle 5212 -prefMapHandle 5248 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8130dc50-d983-4672-bb62-fac8d696ccad} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:4304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5776 -childID 5 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {637cd7dc-9ce8-4635-a0f4-4c9920a5fe96} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5976 -childID 6 -isForBrowser -prefsHandle 5888 -prefMapHandle 5892 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eed89ca0-5396-4b1d-a02b-c9519852e44d} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:2252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7060 -childID 7 -isForBrowser -prefsHandle 7052 -prefMapHandle 6920 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49bc136b-df0b-4f8e-ba7d-7b25e3a5f9fd} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7032 -childID 8 -isForBrowser -prefsHandle 5696 -prefMapHandle 5700 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {68b06d26-9ffa-4a09-a04c-c3690a6250bd} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:3116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7332 -childID 9 -isForBrowser -prefsHandle 7324 -prefMapHandle 7320 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2906b421-0e5f-4583-831d-3891d28f6042} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:3348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7488 -childID 10 -isForBrowser -prefsHandle 7492 -prefMapHandle 7436 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8823652a-9e69-4ec3-915f-3e8c5a9ed676} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7824 -childID 11 -isForBrowser -prefsHandle 7816 -prefMapHandle 7812 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee775bc4-ad45-464a-b868-4fa4184ac406} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:1888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7960 -childID 12 -isForBrowser -prefsHandle 7968 -prefMapHandle 7972 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7422f511-7597-4119-ba55-14c851d72a03} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8492 -childID 13 -isForBrowser -prefsHandle 8484 -prefMapHandle 8480 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {557bcad4-4e79-4d08-827a-6106b455fd69} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8520 -childID 14 -isForBrowser -prefsHandle 8512 -prefMapHandle 8508 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {756e15f1-73cc-458c-beb8-606b4979008b} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8652 -childID 15 -isForBrowser -prefsHandle 8640 -prefMapHandle 8552 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3f84f9aa-8504-43af-915f-d9837323e49b} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:1204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8768 -childID 16 -isForBrowser -prefsHandle 8760 -prefMapHandle 8756 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {275ade3d-de84-45a9-9bce-782f5b90034c} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8796 -childID 17 -isForBrowser -prefsHandle 8788 -prefMapHandle 8784 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c54517f-d070-405a-8498-12f77dbdff4b} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:4800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9476 -childID 18 -isForBrowser -prefsHandle 9320 -prefMapHandle 9328 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca7dd92b-c038-4219-a051-7d803da2c6d0} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9012 -childID 19 -isForBrowser -prefsHandle 9020 -prefMapHandle 9024 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0afa9d6a-66ef-4a66-9100-583a34d8e212} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8364 -childID 20 -isForBrowser -prefsHandle 8200 -prefMapHandle 8204 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {896842f8-2da6-4ac0-8ba3-8116059c87de} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5620
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4224 -childID 21 -isForBrowser -prefsHandle 9672 -prefMapHandle 1088 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5e2228c-a0b4-4148-ad0a-34a07128492b} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4412 -childID 22 -isForBrowser -prefsHandle 9624 -prefMapHandle 9628 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69647812-2737-4b1c-9e04-f9fe058d850e} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4416 -childID 23 -isForBrowser -prefsHandle 3996 -prefMapHandle 3992 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {918ca268-e5b0-4013-9525-1af36362c498} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5684
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9956 -childID 24 -isForBrowser -prefsHandle 9948 -prefMapHandle 9944 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4e7397f-4498-4a22-b067-26134705529a} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:2120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10212 -childID 25 -isForBrowser -prefsHandle 10224 -prefMapHandle 10228 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2fa91be4-8149-4d19-95da-0c464ccec976} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:5848
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10648 -childID 26 -isForBrowser -prefsHandle 10660 -prefMapHandle 10656 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3fca2a9-dcab-4ae1-a471-a99e4f58bde2} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:6404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10264 -childID 27 -isForBrowser -prefsHandle 10068 -prefMapHandle 10072 -prefsLen 27178 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {84e4b97b-5723-46c5-a698-76aa5942dd26} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:7028
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10652 -childID 28 -isForBrowser -prefsHandle 9848 -prefMapHandle 9832 -prefsLen 28249 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {23da6952-16e2-4165-8255-95936755a04e} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:2780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10532 -childID 29 -isForBrowser -prefsHandle 10436 -prefMapHandle 10404 -prefsLen 28249 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6d0ba64-de37-45b6-ac80-2c04e9f1885d} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:3804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10556 -childID 30 -isForBrowser -prefsHandle 9852 -prefMapHandle 10520 -prefsLen 28249 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {984613d8-90ad-4346-8592-021f0286233c} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:7972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1288 -childID 31 -isForBrowser -prefsHandle 6292 -prefMapHandle 6316 -prefsLen 34221 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f16f44cb-3204-4d85-b34f-eaf9a43c917b} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:7628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4912 -childID 32 -isForBrowser -prefsHandle 2832 -prefMapHandle 9700 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39cc936c-d986-4b9f-8fc1-79b1862dcedd} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:3008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10652 -childID 33 -isForBrowser -prefsHandle 10432 -prefMapHandle 6540 -prefsLen 28328 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8092394-4d79-4a71-9629-b257fe2f2a32} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:8444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 34 -isForBrowser -prefsHandle 11236 -prefMapHandle 11232 -prefsLen 28378 -prefMapSize 244658 -jsInitHandle 1340 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {adcfb378-6ae9-406a-8958-9d4563d4fb06} 996 "\\.\pipe\gecko-crash-server-pipe.996" tab
    3⤵
    PID:8796

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x0000000000000480
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7480

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap15215:92:7zEvent9729
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7676

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap3449:92:7zEvent23043
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7756

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
- Modifies registry class
PID:4600

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap11561:92:7zEvent22233
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:680

C:\Users\Admin\Downloads\burpsuite2.4.EXE
"C:\Users\Admin\Downloads\burpsuite2.4.EXE"
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1100
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~1.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~1.EXE
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:1228
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks" /create /tn "svhostt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~1.EXE" /rl HIGHEST /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1088
- - C:\Users\Admin\AppData\Roaming\SubDir\svhostt.exe
    "C:\Users\Admin\AppData\Roaming\SubDir\svhostt.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:7308
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /create /tn "svhostt" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\svhostt.exe" /rl HIGHEST /f
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5116
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks" /delete /tn "svhostt" /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:9124
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tq5kr74VAIHz.bat" "
      4⤵
      System Location Discovery: System Language Discovery
      PID:9192
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping -n 10 localhost
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:7492
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~2.EXE
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~2.EXE
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:6200
- - \??\c:\users\admin\appdata\local\temp\E4J491~1.TMP\jre\bin\java.exe
    c:\users\admin\appdata\local\temp\E4J491~1.TMP\jre\bin\java.exe -version
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    PID:1008
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~2.EXE
    "C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\BURPSU~2.EXE" __i4j_windel C:\Users\Admin\AppData\Local\Temp\i4j9691045197316682559.tmp
    3⤵
    - Executes dropped EXE
    PID:10128

C:\Program Files\BurpSuiteCommunity\BurpSuiteCommunity.exe
"C:\Program Files\BurpSuiteCommunity\BurpSuiteCommunity.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:7592
- \??\c:\PROGRA~1\BURPSU~1\jre\bin\java.exe
  c:\PROGRA~1\BURPSU~1\jre\bin\java.exe -version
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:9116
- C:\Program Files\BurpSuiteCommunity\.install4j\bgupdater.exe
  "C:\Program Files\BurpSuiteCommunity\.install4j\bgupdater.exe" -VupdateVersion=2021.10-10370 -VupdateFile=C:\Users\Admin\AppData\Roaming\BurpSuite\updates\18cbdedb\burpsuite_community_windows-x64_v2021_10.exe -VisArchive=false -Dinstall4j.shutdownFile=C:\Users\Admin\AppData\Local\Temp\i4jshd16965139261898419653.tmp -Dinstall4j.fromService=false "-Dinstall4j.fromLauncher=C:\Program Files\BurpSuiteCommunity\BurpSuiteCommunity.exe" -Dinstall4j.fromLauncherId=70
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:8360
- C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
  "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --proxy-server=localhost:54124 --proxy-bypass-list=<-loopback> --remote-debugging-port=0 --disable-ipc-flooding-protection --disable-xss-auditor --disable-bundled-ppapi-flash --disable-plugins-discovery --disable-default-apps --disable-prerender-local-predictor --disable-save-password-bubble --disable-sync --disable-audio-output --disable-breakpad --disable-crash-reporter --disable-prerender-local-predictor --disk-cache-size=0 --disable-settings-window --disable-notifications --disable-speech-api --disable-file-system --disable-presentation-api --disable-permissions-api --disable-new-zip-unpacker --disable-media-session-api --noerrdialogs --no-experiments --no-events --no-first-run --no-default-browser-check --no-pings --no-service-autorun --media-cache-size=0 --autoplay-policy=document-user-activation-required --overscroll-history-navigation=0 --use-fake-device-for-media-stream --dbus-stub --use-mock-keychain --disable-background-networking --use-gl=angle --useangle=swiftshader-webgl --app=http://burp-documentation.local/burp/documentation/index.html --ignore-certificate-errors --user-data-dir=C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576
  2⤵
  - Uses browser remote debugging
  - Executes dropped EXE
  - Checks system information in the registry
  - Enumerates system info in registry
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:9304
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576\Crashpad --annotation=plat=Win64 --annotation=prod=Chromium --annotation=ver=94.0.4606.61 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffdaf049270,0x7ffdaf049280,0x7ffdaf049290
    3⤵
    - Executes dropped EXE
    PID:7316
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=gpu-process --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --disable-breakpad --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --start-stack-profiler --gpu-preferences=UAAAAAAAAADgAAAIAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --mojo-platform-channel-handle=1684 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:2284
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --service-sandbox-type=network --ignore-certificate-errors --proxy-server=localhost:54124 --use-fake-device-for-media-stream --use-gl=angle --disable-audio-output --ignore-certificate-errors --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --start-stack-profiler --mojo-platform-channel-handle=2028 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7952
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --service-sandbox-type=utility --ignore-certificate-errors --proxy-server=localhost:54124 --use-fake-device-for-media-stream --use-gl=angle --disable-audio-output --ignore-certificate-errors --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --mojo-platform-channel-handle=2040 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:7920
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=renderer --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --cross-origin-webassembly-module-sharing-allowed --display-capture-permissions-policy-allowed --autoplay-policy=document-user-activation-required --disable-breakpad --disable-file-system --disable-notifications --disable-permissions-api --disable-presentation-api --disable-speech-api --remote-debugging-port=0 --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2912 /prefetch:1
    3⤵
    - Uses browser remote debugging
    - Executes dropped EXE
    PID:7820
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=renderer --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --cross-origin-webassembly-module-sharing-allowed --display-capture-permissions-policy-allowed --autoplay-policy=document-user-activation-required --disable-breakpad --disable-file-system --disable-notifications --disable-permissions-api --disable-presentation-api --disable-speech-api --remote-debugging-port=0 --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2920 /prefetch:1
    3⤵
    - Uses browser remote debugging
    - Executes dropped EXE
    PID:8648
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=renderer --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --extension-process --cross-origin-webassembly-module-sharing-allowed --display-capture-permissions-policy-allowed --autoplay-policy=document-user-activation-required --disable-breakpad --disable-file-system --disable-notifications --disable-permissions-api --disable-presentation-api --disable-speech-api --remote-debugging-port=0 --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:1
    3⤵
    - Uses browser remote debugging
    - Executes dropped EXE
    PID:10512
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --proxy-server=localhost:54124 --use-fake-device-for-media-stream --use-gl=angle --disable-audio-output --ignore-certificate-errors --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:7940
- - C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe
    "C:\Program Files\BurpSuiteCommunity\burpbrowser\94.0.4606.61\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1640,9169126518087909950,6880029593074091663,131072 --lang=en-US --service-sandbox-type=none --ignore-certificate-errors --proxy-server=localhost:54124 --use-fake-device-for-media-stream --use-gl=angle --disable-audio-output --ignore-certificate-errors --noerrdialogs --user-agent=c07ohnktrhe3515t5ghqlyu2rqznhssodcllpoho0afw7x9lh1ia799wnb7mj9epgslj7cidesa60y7kxs7ezzt18mhy1xx828br1p7zjlp5mseh1i --user-data-dir="C:\Users\Admin\AppData\Local\Temp\burp-documentation7850554127371871576" --mojo-platform-channel-handle=4552 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:10372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://portswigger.net/burp/upgrade-community-to-pro?utm_source=burp_suite_community&utm_campaign=upgrade_to_pro&utm_medium=button&utm_content=intruder
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of SendNotifyMessage
  PID:8244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x124,0x128,0x12c,0x120,0x130,0x7ffdae543cb8,0x7ffdae543cc8,0x7ffdae543cd8
    3⤵
    PID:10128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:7480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:11092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:3392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:8384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:8260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
    3⤵
    PID:7528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:6284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:9356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:9368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
    3⤵
    PID:9352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2012,14661458823418103403,8989106631470251481,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
    3⤵
    PID:7884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:10336

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdaef0cc40,0x7ffdaef0cc4c,0x7ffdaef0cc58
  2⤵
  PID:8288
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:9072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2096,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  PID:7504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:8
  2⤵
  PID:10228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3340,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4444,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4428 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4568,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  PID:10960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4684,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4884,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5052,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5200,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:10572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5244,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:10684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5236,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:9944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5208,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:7624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8
  2⤵
  PID:10436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5484,i,11815640295218778664,4348711407629968428,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5444 /prefetch:2
  2⤵
  PID:888

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:7788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:10956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:9120

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:10920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:11212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Browser Information Discovery

T1217

Query Registry

Remote System Discovery

T1018

System Information Discovery