gurcu | 21f121c9b506a7536434ce3b0cd7afdbdf07652a57b100723c078f745b73511c

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000\Control Panel\International\Geo\Nation	virustotal.exe

Executes dropped EXE 1 IoCs

pid	Process
1116	virustotal.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
32	raw.githubusercontent.com
33	raw.githubusercontent.com
34	raw.githubusercontent.com

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
4712	tasklist.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
4996	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133878153461027729"	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-308834014-1004923324-1191300197-1000_Classes\Local Settings	OpenWith.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
1508	schtasks.exe
4840	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5844	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe
1116	virustotal.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5844	vlc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	2968	TelegramRAT.exe
Token: SeDebugPrivilege	4712	tasklist.exe
Token: SeDebugPrivilege	1116	virustotal.exe
Token: SeDebugPrivilege	1116	virustotal.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: 33	6064	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6064	AUDIODG.EXE
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	4716	chrome.exe
Token: SeCreatePagefilePrivilege	4716	chrome.exe
Token: SeShutdownPrivilege	1116	virustotal.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
5844	vlc.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe
4716	chrome.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1116	virustotal.exe
2872	OpenWith.exe
4764	OpenWith.exe
5844	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 1508	2968	TelegramRAT.exe	91
PID 2968 wrote to memory of 1508	2968	TelegramRAT.exe	91
PID 2968 wrote to memory of 2028	2968	TelegramRAT.exe	93
PID 2968 wrote to memory of 2028	2968	TelegramRAT.exe	93
PID 2028 wrote to memory of 4712	2028	cmd.exe	95
PID 2028 wrote to memory of 4712	2028	cmd.exe	95
PID 2028 wrote to memory of 4524	2028	cmd.exe	96
PID 2028 wrote to memory of 4524	2028	cmd.exe	96
PID 2028 wrote to memory of 4996	2028	cmd.exe	98
PID 2028 wrote to memory of 4996	2028	cmd.exe	98
PID 2028 wrote to memory of 1116	2028	cmd.exe	99
PID 2028 wrote to memory of 1116	2028	cmd.exe	99
PID 1116 wrote to memory of 4840	1116	virustotal.exe	101
PID 1116 wrote to memory of 4840	1116	virustotal.exe	101
PID 4716 wrote to memory of 4596	4716	chrome.exe	131
PID 4716 wrote to memory of 4596	4716	chrome.exe	131
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1516	4716	chrome.exe	133
PID 4716 wrote to memory of 1516	4716	chrome.exe	133
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 1856	4716	chrome.exe	134
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135
PID 4716 wrote to memory of 2764	4716	chrome.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "discord" /tr "C:\Users\virustotal\virustotal.exe"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1508
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmp639C.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmp639C.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2968"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:4712
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4524
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:4996
- - C:\Users\virustotal\virustotal.exe
    "virustotal.exe"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1116
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "discord" /tr "C:\Users\virustotal\virustotal.exe"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4840

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4764

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\SelectImport.au"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe7011dcf8,0x7ffe7011dd04,0x7ffe7011dd10
  2⤵
  PID:4596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1588,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  PID:1516
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2192,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2436,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1804 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3144,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3332,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4284,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4588,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4876,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5048,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5336,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5560,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5704,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5452,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5488,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5956,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3396,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=3356,i,3682348428893915172,5280559932653062573,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2532

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3668

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b0 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Process Discovery

T1057

Query Registry

System Information Discovery