asyncrat | d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

flow	ioc
367	camo.githubusercontent.com
368	camo.githubusercontent.com
369	camo.githubusercontent.com
1570	mediafire.com
1573	mediafire.com
311	camo.githubusercontent.com
360	camo.githubusercontent.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
547	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	800	firefox.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\playit_gg\bin\playit.exe	msiexec.exe

Drops file in Windows directory 16 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Installer\e6184df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	msiexec.exe
File created	C:\Windows\SystemTemp\~DF65FC415C67608F14.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8C17366B-843B-49DC-AC1B-748DC264E06F}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA8D82E2175B907CB.TMP	msiexec.exe
File created	C:\Windows\Installer\e6184e1.msi	msiexec.exe
File created	C:\Windows\Installer\e6184df.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI859A.tmp	msiexec.exe
File created	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5BEC040ACE9ED6AD.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAD342AD3CC8D8A1C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	Taskmgr.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	asdwasd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AsyncClient.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2228	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b74d468fc327a7de0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000b74d468f0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900b74d468f000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1db74d468f000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b74d468f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
7488	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000000000002000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2 = 19002f433a5c000000000000000000000000000000000000000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	Taskmgr.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	AsyncRAT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	AsyncRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 000000000200000001000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Generic"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	AsyncRAT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\SourceList\PackageName = "playit-windows-x86_64-signed.msi"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	AsyncRAT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\ProductName = "playit"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\SourceList	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0 = 50003100000000004b5ad173100041646d696e003c0009000400efbe4b5a7d6a4f5ae5a42e000000385702000000010000000000000000000000000000000f37fc00410064006d0069006e00000014000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0	AsyncRAT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B66371C8B348CD94CAB147D82C460EF6\Binaries	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\ProductIcon = "C:\\Windows\\Installer\\{8C17366B-843B-49DC-AC1B-748DC264E06F}\\ProductICO"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AsyncRAT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\4AEF046202130BD4399AB6404AFE7E2D	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0 = 78003100000000004b5a7d6a1100557365727300640009000400efbec5522d604f5aeaa42e0000006c0500000000010000000000000000003a00000000006bccf10055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B66371C8B348CD94CAB147D82C460EF6	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	AsyncRAT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\Version = "983066"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000100000000000000ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\MRUListEx = 00000000ffffffff	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	AsyncRAT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\PackageCode = "082D93E786FB56547BF685B7754256F9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\DeploymentFlags = "3"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0 = 5a003100000000004f5ad8a410004173796e635241540000420009000400efbe4f5acea44f5ae3a42e000000f8b302000000170000000000000000000000000000002f5f7a004100730079006e006300520041005400000018000000	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	AsyncRAT.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	AsyncRAT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	AsyncRAT.exe
Key created	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\2\0\0\0\0\MRUListEx = ffffffff	AsyncRAT.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2417498994-1216132997-487892065-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 020000000000000001000000ffffffff	AsyncRAT.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\playit-windows-x86_64-signed.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\COMPILED.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1680	NOTEPAD.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
7552	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
5556	msiexec.exe
5556	msiexec.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
6936	AsyncClient.exe
5808	LocalBridge.exe
5808	LocalBridge.exe
5808	LocalBridge.exe
5808	LocalBridge.exe
5808	LocalBridge.exe
5808	LocalBridge.exe
8752	Taskmgr.exe
8752	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
680	AsyncRAT.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeShutdownPrivilege	1148	chrome.exe
Token: SeCreatePagefilePrivilege	1148	chrome.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeDebugPrivilege	800	firefox.exe
Token: SeShutdownPrivilege	7256	msiexec.exe
Token: SeIncreaseQuotaPrivilege	7256	msiexec.exe
Token: SeSecurityPrivilege	5556	msiexec.exe
Token: SeCreateTokenPrivilege	7256	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	7256	msiexec.exe
Token: SeLockMemoryPrivilege	7256	msiexec.exe
Token: SeIncreaseQuotaPrivilege	7256	msiexec.exe
Token: SeMachineAccountPrivilege	7256	msiexec.exe
Token: SeTcbPrivilege	7256	msiexec.exe
Token: SeSecurityPrivilege	7256	msiexec.exe
Token: SeTakeOwnershipPrivilege	7256	msiexec.exe
Token: SeLoadDriverPrivilege	7256	msiexec.exe
Token: SeSystemProfilePrivilege	7256	msiexec.exe
Token: SeSystemtimePrivilege	7256	msiexec.exe
Token: SeProfSingleProcessPrivilege	7256	msiexec.exe
Token: SeIncBasePriorityPrivilege	7256	msiexec.exe
Token: SeCreatePagefilePrivilege	7256	msiexec.exe
Token: SeCreatePermanentPrivilege	7256	msiexec.exe
Token: SeBackupPrivilege	7256	msiexec.exe
Token: SeRestorePrivilege	7256	msiexec.exe
Token: SeShutdownPrivilege	7256	msiexec.exe
Token: SeDebugPrivilege	7256	msiexec.exe
Token: SeAuditPrivilege	7256	msiexec.exe
Token: SeSystemEnvironmentPrivilege	7256	msiexec.exe
Token: SeChangeNotifyPrivilege	7256	msiexec.exe
Token: SeRemoteShutdownPrivilege	7256	msiexec.exe
Token: SeUndockPrivilege	7256	msiexec.exe
Token: SeSyncAgentPrivilege	7256	msiexec.exe
Token: SeEnableDelegationPrivilege	7256	msiexec.exe
Token: SeManageVolumePrivilege	7256	msiexec.exe
Token: SeImpersonatePrivilege	7256	msiexec.exe
Token: SeCreateGlobalPrivilege	7256	msiexec.exe
Token: SeBackupPrivilege	4456	vssvc.exe
Token: SeRestorePrivilege	4456	vssvc.exe
Token: SeAuditPrivilege	4456	vssvc.exe
Token: SeBackupPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe
Token: SeRestorePrivilege	5556	msiexec.exe
Token: SeTakeOwnershipPrivilege	5556	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
680	AsyncRAT.exe
7256	msiexec.exe
7256	msiexec.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
1148	chrome.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
680	AsyncRAT.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
680	AsyncRAT.exe
800	firefox.exe
800	firefox.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
680	AsyncRAT.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe
8752	Taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
5608	MiniSearchHost.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe
800	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1680	2264	cmd.exe	85
PID 2264 wrote to memory of 1680	2264	cmd.exe	85
PID 1148 wrote to memory of 1480	1148	chrome.exe	89
PID 1148 wrote to memory of 1480	1148	chrome.exe	89
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 1140	1148	chrome.exe	90
PID 1148 wrote to memory of 3980	1148	chrome.exe	91
PID 1148 wrote to memory of 3980	1148	chrome.exe	91
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92
PID 1148 wrote to memory of 2296	1148	chrome.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\test.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffb0b49cc40,0x7ffb0b49cc4c,0x7ffb0b49cc58
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1664,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=1660 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  PID:3980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2140,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=2196 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3060,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4428,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4612,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:572
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4300,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4856,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4884,i,16913352428544792008,4780567614446494686,262144 --variations-seed-version=20250210-180233.097000 --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3648

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:776
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1836 -prefsLen 27359 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c6d7ea1-4d41-4f83-aa8e-4e2d8dd33041} 800 "\\.\pipe\gecko-crash-server-pipe.800" gpu
    3⤵
    PID:2764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2380 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 27237 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {446c7e34-9a81-4f7c-98e1-f98cc34f54b5} 800 "\\.\pipe\gecko-crash-server-pipe.800" socket
    3⤵
    PID:1368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1580 -childID 1 -isForBrowser -prefsHandle 1284 -prefMapHandle 3012 -prefsLen 22636 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f76dbc0-f9c7-4c29-8a58-40a32e3858c5} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:1780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3860 -childID 2 -isForBrowser -prefsHandle 3832 -prefMapHandle 3824 -prefsLen 32611 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e8baf6d-3725-4723-af7b-140dfe355fc9} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:3108
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4876 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 32611 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {88742c84-e756-42e1-a544-34512940db95} 800 "\\.\pipe\gecko-crash-server-pipe.800" utility
    3⤵
    - Checks processor information in registry
    PID:612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5356 -childID 3 -isForBrowser -prefsHandle 5352 -prefMapHandle 5348 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {93c11c5c-9a8f-4666-80a5-c859ee8eab7b} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:4668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5500 -childID 4 -isForBrowser -prefsHandle 5580 -prefMapHandle 5576 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91e450c3-fd77-4445-adb7-5e06df6c567b} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 5 -isForBrowser -prefsHandle 5484 -prefMapHandle 5488 -prefsLen 26928 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e01b944-9f13-4c49-ad73-9a71a5be9e20} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5976 -childID 6 -isForBrowser -prefsHandle 5580 -prefMapHandle 5520 -prefsLen 32470 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {640dee50-a83e-48d8-9eff-f44ecc0fe31a} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:5064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6248 -childID 7 -isForBrowser -prefsHandle 3024 -prefMapHandle 6220 -prefsLen 27114 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {709f2b5b-54a5-4979-be23-f10f5dfac042} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:3556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3592 -childID 8 -isForBrowser -prefsHandle 6340 -prefMapHandle 6556 -prefsLen 27114 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31757285-5f44-4a2c-b132-836a8c51103e} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:4596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4660 -parentBuildID 20240401114208 -prefsHandle 4620 -prefMapHandle 4628 -prefsLen 32895 -prefMapSize 244628 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1d7be44-cffd-49b9-ba7f-6b481c611999} 800 "\\.\pipe\gecko-crash-server-pipe.800" rdd
    3⤵
    PID:3816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4604 -childID 9 -isForBrowser -prefsHandle 6844 -prefMapHandle 6848 -prefsLen 27519 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b75a049b-9f28-4391-b0e7-28be1c7a1190} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:5996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5472 -childID 10 -isForBrowser -prefsHandle 5712 -prefMapHandle 5724 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12e59e2f-3962-4d47-8585-e91606f38f97} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7240 -childID 11 -isForBrowser -prefsHandle 7228 -prefMapHandle 7008 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf7d4d1-9b84-42cc-9362-c6abdadb7159} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:5484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7484 -childID 12 -isForBrowser -prefsHandle 7476 -prefMapHandle 7056 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d6f880c-ce91-45b1-9dad-4ef1408a2f6b} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:5544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7420 -childID 13 -isForBrowser -prefsHandle 7544 -prefMapHandle 7540 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3bdb806-b7f0-4e53-a19c-dbbb6fdf8395} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6828 -childID 14 -isForBrowser -prefsHandle 6860 -prefMapHandle 3036 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0539bde7-a593-486e-9707-633e1cd37b45} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:1068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4344 -childID 15 -isForBrowser -prefsHandle 5812 -prefMapHandle 5500 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c159375c-f9e5-44c0-8e2a-1b84037cbf73} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:1668
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7876 -childID 16 -isForBrowser -prefsHandle 7704 -prefMapHandle 7660 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fe7ef82-7ef4-452f-8b21-a2cdf9e30d1a} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3124 -childID 17 -isForBrowser -prefsHandle 9000 -prefMapHandle 8996 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa17e213-918e-4e89-8c34-fe3767a8bd8d} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9960 -childID 18 -isForBrowser -prefsHandle 9952 -prefMapHandle 9948 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1210b4d6-7407-4889-b640-782589d678bc} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10160 -childID 19 -isForBrowser -prefsHandle 10168 -prefMapHandle 10172 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00dda4eb-afb3-4672-859e-86923971290c} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:3364
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10480 -childID 20 -isForBrowser -prefsHandle 10536 -prefMapHandle 10540 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b1c2504-ade3-4a49-9809-1896ff9f10fa} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10380 -childID 21 -isForBrowser -prefsHandle 10368 -prefMapHandle 10304 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4798b08-81fc-4991-afe6-8d5deee860e4} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:4716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10592 -childID 22 -isForBrowser -prefsHandle 10600 -prefMapHandle 10604 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9758b35-f36e-4f11-9b64-bf4abb8278e8} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6224
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10648 -childID 23 -isForBrowser -prefsHandle 10640 -prefMapHandle 10396 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e0330ba-5bc6-4dbd-ba91-1680b8346a99} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11036 -childID 24 -isForBrowser -prefsHandle 10956 -prefMapHandle 10960 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2592fdb8-2a70-4782-a0c0-01eda4e8a2c3} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11236 -childID 25 -isForBrowser -prefsHandle 11160 -prefMapHandle 11228 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6133eae4-1636-48a9-84cf-4afbbe5ee9ff} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6268
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9868 -childID 26 -isForBrowser -prefsHandle 11408 -prefMapHandle 11412 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {882475be-fe1f-4bbe-b41e-e9b43b1735bc} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11468 -childID 27 -isForBrowser -prefsHandle 1344 -prefMapHandle 9852 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aea52567-a8d3-4478-a708-0076eb5ba7e0} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8972 -childID 28 -isForBrowser -prefsHandle 11468 -prefMapHandle 7468 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4b51432-70eb-43d4-aad5-86f8713d04b2} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6488
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9864 -childID 29 -isForBrowser -prefsHandle 2928 -prefMapHandle 11768 -prefsLen 27951 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8a0148d-b699-423c-9e3a-b27d803156e0} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6680
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6524 -childID 30 -isForBrowser -prefsHandle 8524 -prefMapHandle 9936 -prefsLen 27991 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d59063c-270f-4c52-a68a-f0a72c78b3e6} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5144 -childID 31 -isForBrowser -prefsHandle 12184 -prefMapHandle 12172 -prefsLen 27991 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7fae3ff-e8d0-4f9c-a44d-af28e1a76c8c} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4720 -childID 32 -isForBrowser -prefsHandle 12208 -prefMapHandle 12204 -prefsLen 27991 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca54e23c-68c4-43dc-9e81-cd4967717bdb} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12180 -childID 33 -isForBrowser -prefsHandle 11840 -prefMapHandle 5652 -prefsLen 28047 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {499dc9de-f201-4401-a820-307a1989a1a4} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6460 -childID 34 -isForBrowser -prefsHandle 4360 -prefMapHandle 6968 -prefsLen 28047 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {287cd9f2-10e7-4548-b894-a46e68dadba9} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7144 -childID 35 -isForBrowser -prefsHandle 7052 -prefMapHandle 5716 -prefsLen 28047 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7b536b-be72-4dbb-81e1-b27f6d254f41} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:3316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10864 -childID 36 -isForBrowser -prefsHandle 4372 -prefMapHandle 12072 -prefsLen 28291 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6d81e17-6ab8-483e-9c56-685878e5355a} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7448
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=12216 -childID 37 -isForBrowser -prefsHandle 4904 -prefMapHandle 5024 -prefsLen 28291 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d99a5519-6b15-480e-9ad0-ac5bb39f547e} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:4864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8328 -childID 38 -isForBrowser -prefsHandle 3556 -prefMapHandle 8168 -prefsLen 28291 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ec77696-f03d-4ae6-b79d-cb789c11b753} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:7852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11532 -childID 39 -isForBrowser -prefsHandle 12248 -prefMapHandle 11608 -prefsLen 28291 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a749fc5e-caf9-496a-9db6-a02282800eae} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:6148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8744 -childID 40 -isForBrowser -prefsHandle 3608 -prefMapHandle 11612 -prefsLen 28291 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {076469a9-4199-4495-a87e-cd2440ee8342} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:8016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11608 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 11472 -prefMapHandle 12532 -prefsLen 34248 -prefMapSize 244628 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {569bf1bd-4c65-4c8a-9a3d-404e2c6974cc} 800 "\\.\pipe\gecko-crash-server-pipe.800" utility
    3⤵
    - Checks processor information in registry
    PID:5992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10856 -childID 41 -isForBrowser -prefsHandle 11832 -prefMapHandle 6852 -prefsLen 28291 -prefMapSize 244628 -jsInitHandle 1204 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d4334136-eb45-4d7e-bce3-e3d88f227516} 800 "\\.\pipe\gecko-crash-server-pipe.800" tab
    3⤵
    PID:2300

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RjI0MUJEMTQtM0VCRS00RUYxLTkyOUQtN0UzOUVCRDcyNkQ1fSIgdXNlcmlkPSJ7NTg5RDgwRjYtMTNCOC00MkJGLUE5RTktRUU5OEI5RDcwN0NEfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7ODdBRUFCRDktMEFERC00OTAyLTlEMzMtN0UyRjNEMjczMTNEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC40OTMiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7RSt4YkF6Nlk2c1UxMjg5YlM2cWw0VlJMYmtqZkJVR1RNSnNqckhyNDRpST0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7OEE2OUQzNDUtRDU2NC00NjNjLUFGRjEtQTY5RDlFNTMwRjk2fSIgdmVyc2lvbj0iMTIzLjAuNjMxMi4xMjMiIG5leHR2ZXJzaW9uPSIiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiIGluc3RhbGxhZ2U9IjQiIGluc3RhbGxkYXRldGltZT0iMTczOTI4MjMwMiIgb29iZV9pbnN0YWxsX3RpbWU9IjEzMzgzNzUzNTk3Mjc0MDAwMCI-PGV2ZW50IGV2ZW50dHlwZT0iMzEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjIxNzk4NjIiIHN5c3RlbV91cHRpbWVfdGlja3M9IjUxNTUxNTYxMjciLz48L2FwcD48L3JlcXVlc3Q-
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:2228

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:5608

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6128

C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe
"C:\Users\Admin\Desktop\AsyncRAT\AsyncRAT.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:680

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:6968

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\playit-windows-x86_64-signed.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:7256

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5556
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2024

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Program Files\playit_gg\bin\playit.exe
"C:\Program Files\playit_gg\bin\playit.exe"
1⤵
- Executes dropped EXE
PID:6236

C:\Users\Admin\Desktop\AsyncClient.exe
"C:\Users\Admin\Desktop\AsyncClient.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:6936
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "asdwasd" /tr '"C:\Users\Admin\AppData\Roaming\asdwasd.exe"' & exit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:8076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "asdwasd" /tr '"C:\Users\Admin\AppData\Roaming\asdwasd.exe"'
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:7552
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDAB7.tmp.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1556
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:7488
- - C:\Users\Admin\AppData\Roaming\asdwasd.exe
    "C:\Users\Admin\AppData\Roaming\asdwasd.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6928

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5808

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:8752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery