azorult | a6d1246d2054da7e30d2d65a8f975b64fb162a501d5967fca963272927a3b41c

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	iimo3.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	iimo3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	iimo3.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeWebview_X64_132.0.2957.115.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 17 IoCs

pid	Process
4472	ZoraraB.exe
3520	WebView2Runtime.exe
5408	MicrosoftEdgeUpdate.exe
3516	MicrosoftEdgeUpdate.exe
5104	MicrosoftEdgeUpdate.exe
6060	MicrosoftEdgeUpdateComRegisterShell64.exe
3452	MicrosoftEdgeUpdateComRegisterShell64.exe
5356	MicrosoftEdgeUpdateComRegisterShell64.exe
2844	MicrosoftEdgeUpdate.exe
3512	MicrosoftEdgeUpdate.exe
1724	MicrosoftEdgeUpdate.exe
5416	MicrosoftEdgeUpdate.exe
844	MicrosoftEdgeUpdate.exe
1100	MicrosoftEdgeWebview_X64_132.0.2957.115.exe
5256	setup.exe
4980	setup.exe
3304	MicrosoftEdgeUpdate.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Software\Wine	iimo3.exe

Loads dropped DLL 35 IoCs

pid	Process
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
4472	ZoraraB.exe
5408	MicrosoftEdgeUpdate.exe
3516	MicrosoftEdgeUpdate.exe
5104	MicrosoftEdgeUpdate.exe
6060	MicrosoftEdgeUpdateComRegisterShell64.exe
5104	MicrosoftEdgeUpdate.exe
3452	MicrosoftEdgeUpdateComRegisterShell64.exe
5104	MicrosoftEdgeUpdate.exe
5356	MicrosoftEdgeUpdateComRegisterShell64.exe
5104	MicrosoftEdgeUpdate.exe
2844	MicrosoftEdgeUpdate.exe
3512	MicrosoftEdgeUpdate.exe
1724	MicrosoftEdgeUpdate.exe
1724	MicrosoftEdgeUpdate.exe
3512	MicrosoftEdgeUpdate.exe
5416	MicrosoftEdgeUpdate.exe
844	MicrosoftEdgeUpdate.exe
3304	MicrosoftEdgeUpdate.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
94	camo.githubusercontent.com
104	camo.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	Petya.exe

Checks system information in the registry 2 TTPs 12 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
5320	iimo3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_hr.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_sr.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline\{C7449629-A7B2-4E62-BE59-1B7C95F3A10F}\OfflineManifest.gup	MicrosoftEdgeUpdate.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\psuser_arm64.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_lv.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ms.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_pt-PT.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_sl.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_vi.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_quz.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_is.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_as.dll	WebView2Runtime.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdate.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_lt.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_nb.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeUpdateBroker.exe	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeUpdateOnDemand.exe	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\NOTICE.TXT	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_es-419.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_sk.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_bn-IN.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\psmachine_arm64.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_gu.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ne.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_de.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_hu.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeComRegisterShellARM64.exe	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\psmachine_64.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\psuser.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ko.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_te.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeUpdateSetup.exe	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_mr.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_bs.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_lo.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_tt.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_cs.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_pa.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ar.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_el.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ta.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_af.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_eu.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_mk.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\EdgeUpdate.dat	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ml.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ur.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_gl.dll	WebView2Runtime.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_pt-BR.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeUpdate.exe	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ga.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_lb.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\EDGEMITMP_85F00.tmp\SETUP.EX_	MicrosoftEdgeWebview_X64_132.0.2957.115.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_ru.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_fi.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_id.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_it.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_zh-CN.dll	WebView2Runtime.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Offline\{C7449629-A7B2-4E62-BE59-1B7C95F3A10F}\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\MicrosoftEdge_X64_132.0.2957.115.exe	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_gd.dll	WebView2Runtime.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\msedgeupdateres_sr-Cyrl-RS.dll	WebView2Runtime.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wermgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jey.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iimo3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Petya.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WebView2Runtime.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3304	MicrosoftEdgeUpdate.exe
2844	MicrosoftEdgeUpdate.exe
5416	MicrosoftEdgeUpdate.exe
844	MicrosoftEdgeUpdate.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wermgr.exe

Enumerates system info in registry 2 TTPs 7 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	wermgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	wermgr.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133875618836339736"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.ProcessLauncher\CLSID\ = "{08D832B9-D2FD-481F-98CF-904D00DF63CC}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ = "IApp2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachine\CurVer\ = "MicrosoftEdgeUpdate.PolicyStatusMachine.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{41E1FADF-C62D-4DF4-A0A2-A3BEB272D8AF}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7584D24A-E056-4EB1-8E7B-632F2B0ADC69}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\NumMethods\ = "6"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback\CurVer\ = "MicrosoftEdgeUpdate.OnDemandCOMClassMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\NumMethods\ = "5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\ProgID\ = "MicrosoftEdgeUpdate.PolicyStatusMachineFallback.1.0"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\NumMethods\ = "16"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0B482A5-71D4-4395-857C-1F3B57FB8809}\InProcServer32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\ = "IJobObserver2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\ProxyStubClsid32\ = "{A0B482A5-71D4-4395-857C-1F3B57FB8809}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\psmachine.dll"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0B482A5-71D4-4395-857C-1F3B57FB8809}\InProcServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\NumMethods\ = "10"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\NumMethods\ = "11"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.43\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.CredentialDialogMachine.1.0\ = "Microsoft Edge Update CredentialDialog"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{450CF5FF-95C4-4679-BECA-22680389ECB9}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
1852	chrome.exe
1852	chrome.exe
5408	MicrosoftEdgeUpdate.exe
5408	MicrosoftEdgeUpdate.exe
5408	MicrosoftEdgeUpdate.exe
5408	MicrosoftEdgeUpdate.exe
5408	MicrosoftEdgeUpdate.exe
5408	MicrosoftEdgeUpdate.exe
5320	iimo3.exe
5320	iimo3.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe
1612	stak.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2340	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe
Token: SeShutdownPrivilege	5492	chrome.exe
Token: SeCreatePagefilePrivilege	5492	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5972	7zG.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe
5492	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
5684	OpenWith.exe
2340	OpenWith.exe
5564	jey.exe
4332	Petya.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5492 wrote to memory of 3768	5492	chrome.exe	91
PID 5492 wrote to memory of 3768	5492	chrome.exe	91
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 3428	5492	chrome.exe	92
PID 5492 wrote to memory of 2976	5492	chrome.exe	93
PID 5492 wrote to memory of 2976	5492	chrome.exe	93
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94
PID 5492 wrote to memory of 1628	5492	chrome.exe	94

C:\Users\Admin\AppData\Local\Temp\Slendytubbies 3 Multiplayer.exe
"C:\Users\Admin\AppData\Local\Temp\Slendytubbies 3 Multiplayer.exe"
1⤵
PID:1492

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa60acdcf8,0x7ffa60acdd04,0x7ffa60acdd10
  2⤵
  PID:3768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2000,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2244,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2384,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4312,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4688,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5412,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5532,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5428,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5580,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5548,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5880,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5804,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3404,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5692,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3284 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3308,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:1712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3192,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3240 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4872,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=3508,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5936,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:5940
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5908,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=3504,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:432
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5968,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6416,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5864,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6412 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6512,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6660,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=5924,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=4592,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=4848,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6872,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=6588,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:5532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7052,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6936 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=7468,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7248 /prefetch:1
  2⤵
  PID:636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7032,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7440,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=7260,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=6176,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=7400,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=7444 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=6584,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6440,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:2332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=5624,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=6504,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6408,i,11248217196371797339,10630839668849890305,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:5336

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4216

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2808

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5116

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\Malware-master\" -spe -an -ai#7zMap22592:86:7zEvent1246
1⤵
- Suspicious use of FindShellTrayWindow
PID:5972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5684

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2340

C:\Users\Admin\Desktop\ZoraraB.exe
"C:\Users\Admin\Desktop\ZoraraB.exe"
1⤵
PID:968
- C:\Users\Admin\AppData\Local\Temp\onefile_968_133875621191994413\ZoraraB.exe
  C:\Users\Admin\Desktop\ZoraraB.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4472
- - C:\Users\Admin\AppData\Local\Temp\WebView2Runtime.exe
    C:\Users\Admin\AppData\Local\Temp\WebView2Runtime.exe /silent /install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    PID:3520
  - - C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\Temp\EU8941.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers"
      4⤵
      Event Triggered Execution: Image File Execution Options Injection
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Checks system information in the registry
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:5408
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3516
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5104
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:6060
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3452
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.43\MicrosoftEdgeUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5356
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkFENDVBRTItNDI0Qy00NjA5LUE5OTktRTdCQjlCMTE2QUZEfSIgdXNlcmlkPSJ7QTVCODg5OTAtMjE4MC00RjZFLUEzQ0MtQzQ1MkIzNkUwNDg3fSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntGNTQzMUJCQi1DMEI5LTQ4NTQtQjQzNC0xRUFGNEZEMjE5MTV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iMTYiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuNDMiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjQzIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDY1MTU2NjM3IiBpbnN0YWxsX3RpbWVfbXM9IjUxNiIvPjwvYXBwPjwvcmVxdWVzdD4
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:2844
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20WebView2%20Runtime&needsadmin=Prefers" /installsource offline /sessionid "{2AD45AE2-424C-4609-A999-E7BB9B116AFD}" /silent /offlinedir "{C7449629-A7B2-4E62-BE59-1B7C95F3A10F}"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:3512

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1724
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkFENDVBRTItNDI0Qy00NjA5LUE5OTktRTdCQjlCMTE2QUZEfSIgdXNlcmlkPSJ7QTVCODg5OTAtMjE4MC00RjZFLUEzQ0MtQzQ1MkIzNkUwNDg3fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7N0FCOTNGMkUtQ0QyNy00RUUyLTkyNzctQjE2NzBGMEE4ODk5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtFK3hiQXo2WTZzVTEyODliUzZxbDRWUkxia2pmQlVHVE1Kc2pySHI0NGlJPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins4QTY5RDM0NS1ENTY0LTQ2M2MtQUZGMS1BNjlEOUU1MzBGOTZ9IiB2ZXJzaW9uPSIxMzMuMC42OTQzLjYwIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxMyIgaW5zdGFsbGRhdGV0aW1lPSIxNzQxOTM0NTk1IiBvb2JlX2luc3RhbGxfdGltZT0iMTMzODY0MDcxNTc4MTgwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ3MDAxMDgyNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5416
- C:\Windows\SysWOW64\wermgr.exe
  "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1724" "1172" "1064" "1176" "0" "0" "0" "0" "0" "0" "0" "0"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Enumerates system info in registry
  PID:836
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkFENDVBRTItNDI0Qy00NjA5LUE5OTktRTdCQjlCMTE2QUZEfSIgdXNlcmlkPSJ7QTVCODg5OTAtMjE4MC00RjZFLUEzQ0MtQzQ1MkIzNkUwNDg3fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7QUJDMTIxRTYtOEMxQy00QjIyLUE2MTUtNkI4NUFBRjQ2RUE5fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSIxMzMuMC4zMDY1LjY5IiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMTMiIGluc3RhbGxkYXRldGltZT0iMTc0MTkzMzg5MiI-PGV2ZW50IGV2ZW50dHlwZT0iMzIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjQiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0Nzg2MzUzNjEiLz48L2FwcD48L3JlcXVlc3Q-
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:844
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\MicrosoftEdgeWebview_X64_132.0.2957.115.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\MicrosoftEdgeWebview_X64_132.0.2957.115.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:1100
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\EDGEMITMP_85F00.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\EDGEMITMP_85F00.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\MicrosoftEdgeWebview_X64_132.0.2957.115.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:5256
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\EDGEMITMP_85F00.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\EDGEMITMP_85F00.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.84 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{B05C6171-99F9-4C98-B747-33C8F4241988}\EDGEMITMP_85F00.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=132.0.2957.115 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff7104fa818,0x7ff7104fa824,0x7ff7104fa830
      4⤵
      Executes dropped EXE
      PID:4980
- - C:\Windows\system32\wermgr.exe
    "C:\Windows\system32\wermgr.exe" "-outproc" "0" "1100" "696" "460" "692" "0" "0" "0" "0" "0" "0" "0" "0"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    PID:4664
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MkFENDVBRTItNDI0Qy00NjA5LUE5OTktRTdCQjlCMTE2QUZEfSIgdXNlcmlkPSJ7QTVCODg5OTAtMjE4MC00RjZFLUEzQ0MtQzQ1MkIzNkUwNDg3fSIgaW5zdGFsbHNvdXJjZT0ib2ZmbGluZSIgcmVxdWVzdGlkPSJ7RjkyMjJFMjctRDlCQi00MDhFLThDNUItQ0I5NzNFOUU2MDk1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjE2IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDEuMTI4OCIgc3A9IiIgYXJjaD0ieDY0IiBwcm9kdWN0X3R5cGU9IjQ4IiBpc193aXA9IjAiIGlzX2luX2xvY2tkb3duX21vZGU9IjAiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSIiIHByb2R1Y3RfbmFtZT0iIi8-PGV4cCBldGFnPSImcXVvdDtWUFFvUDFGK2ZxMTV3UnpoMWtQTDRQTXBXaDhPUk1CNWl6dnJPQy9jaGpRPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMzIuMC4yOTU3LjExNSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjEzIiBpbnN0YWxsZGF0ZT0iNjY0MyI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDgwNTA3ODE3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzQ4MDUwNzgxNyIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0OTA5OTMzNTMiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NTA1NzIwNTE5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjYiIGVycm9yY29kZT0iNCIgZXh0cmFjb2RlMT0iMTA3Mzc0MTgyNCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODAxMDQ2MTg1NiIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjE1IiBkb3dubG9hZGVkPSIxNzcwOTgzMzYiIHRvdGFsPSIxNzcwOTgzMzYiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIxIiBpbnN0YWxsX3RpbWVfbXM9IjUwNDc0Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Clean-memz.bat" "
1⤵
PID:3288
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:5768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Clean-memz.bat" "
1⤵
PID:1264
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:1644

C:\Users\Admin\Desktop\Malware-1-master\jey.exe
"C:\Users\Admin\Desktop\Malware-1-master\jey.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5564

C:\Users\Admin\Desktop\Malware-1-master\iimo3.exe
"C:\Users\Admin\Desktop\Malware-1-master\iimo3.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:5320

C:\Users\Admin\Desktop\Malware-1-master\stak.exe
"C:\Users\Admin\Desktop\Malware-1-master\stak.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Users\Admin\Desktop\Malware-1-master\Petya.exe
"C:\Users\Admin\Desktop\Malware-1-master\Petya.exe"
1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Virtualization/Sandbox Evasion