modiloader | 4d0f4d4b0c4be9677d69985483ef77988e997c47457b26a16609fcc89bad5242

pid	Process
2080	msedge.exe
3228	Chrome.exe
4696	Chrome.exe
1764	Chrome.exe
1412	Chrome.exe
2708	msedge.exe
2092	Chrome.exe
3608	Chrome.exe
4116	msedge.exe
3480	Chrome.exe
4676	Chrome.exe
1404	Chrome.exe
3704	msedge.exe
772	msedge.exe
2704	msedge.exe
4000	Chrome.exe
3576	Chrome.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	rdha.pif
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	rundll32.exe
Key value queried	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Control Panel\International\Geo\Nation	rundll32.exe

Executes dropped EXE 14 IoCs

pid	Process
4584	expha.pif
3692	expha.pif
3120	expha.pif
4276	alpha.pif
1284	ghf.pif
4612	alpha.pif
3008	ghf.pif
1780	alpha.pif
916	rdha.pif
2644	chrome.PIF
1280	alpha.pif
5104	alpha.pif
2620	Dguhdowe.PIF
6056	Dguhdowe.PIF

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-83325578-304917428-1200496059-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	recover.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 2376	5104	SndVol.exe	142
PID 5104 set thread context of 4872	5104	SndVol.exe	143
PID 5104 set thread context of 1832	5104	SndVol.exe	145

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chrome.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SndVol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SndVol.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	alpha.pif
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dguhdowe.PIF
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	recover.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dguhdowe.PIF

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1780	alpha.pif
2740	PING.EXE
1880	PING.EXE

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880511040789856"	Chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-83325578-304917428-1200496059-1000\{1429E988-DFAA-4EF1-A941-4231006B050C}	msedge.exe

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
2740	PING.EXE
1880	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
4032	powershell.exe
2644	chrome.PIF
2644	chrome.PIF
5104	SndVol.exe
5104	SndVol.exe
2376	recover.exe
2376	recover.exe
1832	recover.exe
1832	recover.exe
4000	Chrome.exe
4000	Chrome.exe
2376	recover.exe
2376	recover.exe
5104	SndVol.exe
5104	SndVol.exe
2620	Dguhdowe.PIF
2620	Dguhdowe.PIF

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
5104	SndVol.exe
5104	SndVol.exe
5104	SndVol.exe
5104	SndVol.exe
5104	SndVol.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	powershell.exe
Token: SeDebugPrivilege	1832	recover.exe
Token: SeShutdownPrivilege	4000	Chrome.exe
Token: SeCreatePagefilePrivilege	4000	Chrome.exe
Token: SeShutdownPrivilege	4000	Chrome.exe
Token: SeCreatePagefilePrivilege	4000	Chrome.exe
Token: SeShutdownPrivilege	4000	Chrome.exe
Token: SeCreatePagefilePrivilege	4000	Chrome.exe
Token: SeShutdownPrivilege	4000	Chrome.exe
Token: SeCreatePagefilePrivilege	4000	Chrome.exe
Token: SeShutdownPrivilege	4000	Chrome.exe
Token: SeCreatePagefilePrivilege	4000	Chrome.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
5104	SndVol.exe
4000	Chrome.exe
4000	Chrome.exe
3704	msedge.exe
3704	msedge.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
5104	SndVol.exe
5104	SndVol.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 4032	2340	cmd.exe	88
PID 2340 wrote to memory of 4032	2340	cmd.exe	88
PID 2340 wrote to memory of 1980	2340	cmd.exe	89
PID 2340 wrote to memory of 1980	2340	cmd.exe	89
PID 2340 wrote to memory of 4584	2340	cmd.exe	90
PID 2340 wrote to memory of 4584	2340	cmd.exe	90
PID 2340 wrote to memory of 3692	2340	cmd.exe	91
PID 2340 wrote to memory of 3692	2340	cmd.exe	91
PID 2340 wrote to memory of 3120	2340	cmd.exe	92
PID 2340 wrote to memory of 3120	2340	cmd.exe	92
PID 2340 wrote to memory of 4276	2340	cmd.exe	93
PID 2340 wrote to memory of 4276	2340	cmd.exe	93
PID 4276 wrote to memory of 1284	4276	alpha.pif	94
PID 4276 wrote to memory of 1284	4276	alpha.pif	94
PID 2340 wrote to memory of 4612	2340	cmd.exe	95
PID 2340 wrote to memory of 4612	2340	cmd.exe	95
PID 4612 wrote to memory of 3008	4612	alpha.pif	96
PID 4612 wrote to memory of 3008	4612	alpha.pif	96
PID 2340 wrote to memory of 1780	2340	cmd.exe	100
PID 2340 wrote to memory of 1780	2340	cmd.exe	100
PID 1780 wrote to memory of 2740	1780	alpha.pif	101
PID 1780 wrote to memory of 2740	1780	alpha.pif	101
PID 2340 wrote to memory of 916	2340	cmd.exe	106
PID 2340 wrote to memory of 916	2340	cmd.exe	106
PID 916 wrote to memory of 2644	916	rdha.pif	107
PID 916 wrote to memory of 2644	916	rdha.pif	107
PID 916 wrote to memory of 2644	916	rdha.pif	107
PID 2340 wrote to memory of 4012	2340	cmd.exe	108
PID 2340 wrote to memory of 4012	2340	cmd.exe	108
PID 2644 wrote to memory of 3700	2644	chrome.PIF	112
PID 2644 wrote to memory of 3700	2644	chrome.PIF	112
PID 2644 wrote to memory of 3700	2644	chrome.PIF	112
PID 2644 wrote to memory of 3932	2644	chrome.PIF	113
PID 2644 wrote to memory of 3932	2644	chrome.PIF	113
PID 2644 wrote to memory of 3932	2644	chrome.PIF	113
PID 3700 wrote to memory of 3432	3700	cmd.exe	116
PID 3700 wrote to memory of 3432	3700	cmd.exe	116
PID 3700 wrote to memory of 3432	3700	cmd.exe	116
PID 3932 wrote to memory of 1880	3932	cmd.exe	117
PID 3932 wrote to memory of 1880	3932	cmd.exe	117
PID 3932 wrote to memory of 1880	3932	cmd.exe	117
PID 3700 wrote to memory of 1280	3700	cmd.exe	118
PID 3700 wrote to memory of 1280	3700	cmd.exe	118
PID 3700 wrote to memory of 1280	3700	cmd.exe	118
PID 3700 wrote to memory of 5104	3700	cmd.exe	119
PID 3700 wrote to memory of 5104	3700	cmd.exe	119
PID 3700 wrote to memory of 5104	3700	cmd.exe	119
PID 2644 wrote to memory of 3604	2644	chrome.PIF	120
PID 2644 wrote to memory of 3604	2644	chrome.PIF	120
PID 2644 wrote to memory of 3604	2644	chrome.PIF	120
PID 3604 wrote to memory of 3204	3604	cmd.exe	124
PID 3604 wrote to memory of 3204	3604	cmd.exe	124
PID 3604 wrote to memory of 3204	3604	cmd.exe	124
PID 2644 wrote to memory of 5104	2644	chrome.PIF	126
PID 2644 wrote to memory of 5104	2644	chrome.PIF	126
PID 2644 wrote to memory of 5104	2644	chrome.PIF	126
PID 2644 wrote to memory of 5104	2644	chrome.PIF	126
PID 4000 wrote to memory of 3360	4000	Chrome.exe	136
PID 4000 wrote to memory of 3360	4000	Chrome.exe	136
PID 4000 wrote to memory of 3768	4000	Chrome.exe	137
PID 4000 wrote to memory of 3768	4000	Chrome.exe	137
PID 4000 wrote to memory of 3768	4000	Chrome.exe	137
PID 4000 wrote to memory of 3768	4000	Chrome.exe	137
PID 4000 wrote to memory of 3768	4000	Chrome.exe	137

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\PO_0908-0989989_RoyalInternationalConstructionL.L.C.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  PowerShell.exe -WindowStyle hidden -inputformat none -outputformat none -NonInteractive -Command
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4032
- C:\Windows\system32\extrac32.exe
  extrac32 /C /Y "C:\\Windows\\System32\\extrac32.exe" "C:\\Users\\Public\\Libraries\\expha.pif"
  2⤵
  PID:1980
- C:\Users\Public\Libraries\expha.pif
  C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\\Windows\\System32\\cmd.exe" "C:\\Users\\Public\\Libraries\\alpha.pif"
  2⤵
  - Executes dropped EXE
  PID:4584
- C:\Users\Public\Libraries\expha.pif
  C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\\Windows\\System32\\rundll32.exe" "C:\\Users\\Public\\Libraries\\rdha.pif"
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Users\Public\Libraries\expha.pif
  C:\\Users\\Public\\Libraries\\expha.pif /C /Y "C:\Windows\System32\certutil.exe" "C:\\Users\\Public\\Libraries\\ghf.pif"
  2⤵
  - Executes dropped EXE
  PID:3120
- C:\Users\Public\Libraries\alpha.pif
  C:\\Users\\Public\\Libraries\\alpha.pif /C C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Admin\AppData\Local\Temp\PO_0908-0989989_RoyalInternationalConstructionL.L.C.cmd" "C:\Users\Public\\Libraries\donex.avi" 9
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Users\Public\Libraries\ghf.pif
    C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Admin\AppData\Local\Temp\PO_0908-0989989_RoyalInternationalConstructionL.L.C.cmd" "C:\Users\Public\\Libraries\donex.avi" 9
    3⤵
    - Executes dropped EXE
    PID:1284
- C:\Users\Public\Libraries\alpha.pif
  C:\\Users\\Public\\Libraries\\alpha.pif /C C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Public\\Libraries\donex.avi" "C:\Users\Public\\Libraries\chrome.PIF" 12
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Users\Public\Libraries\ghf.pif
    C:\\Users\\Public\\Libraries\\ghf.pif -decodehex -f "C:\Users\Public\\Libraries\donex.avi" "C:\Users\Public\\Libraries\chrome.PIF" 12
    3⤵
    - Executes dropped EXE
    PID:3008
- C:\Users\Public\Libraries\alpha.pif
  C:\\Users\\Public\\Libraries\\alpha.pif /c PING -n 4 127.0.0.1
  2⤵
  - Executes dropped EXE
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\PING.EXE
    PING -n 4 127.0.0.1
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:2740
- C:\Users\Public\Libraries\rdha.pif
  C:\\Users\\Public\\Libraries\\rdha.pif zipfldr.dll,RouteTheCall C:\Users\Public\\Libraries\chrome.PIF
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Public\Libraries\chrome.PIF
    "C:\Users\Public\Libraries\chrome.PIF"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\\ProgramData\\672.cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3700
    - - C:\Windows\SysWOW64\esentutl.exe
        
        C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
        5⤵
        
        PID:3432
    - - C:\Users\Public\alpha.pif
        
        C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1280
    - - C:\Users\Public\alpha.pif
        
        C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:5104
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\\ProgramData\\31419.cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3932
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1 -n 10
        5⤵
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c C:\\ProgramData\\623.cmd
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3604
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /sc minute /mo 1 /tn "Dguhdowe" /tr C:\\ProgramData\\Dguhdowe.url"
        5⤵
        System Location Discovery: System Language Discovery
        Scheduled Task/Job: Scheduled Task
        
        PID:3204
  - - C:\Windows\SysWOW64\SndVol.exe
      C:\Windows\System32\SndVol.exe
      4⤵
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      PID:5104
    - - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4000
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffed0a1dcf8,0x7ffed0a1dd04,0x7ffed0a1dd10
        6⤵
        
        PID:3360
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1868,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1860 /prefetch:2
        6⤵
        
        PID:3768
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --field-trial-handle=2220,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2216 /prefetch:3
        6⤵
        
        PID:4112
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --field-trial-handle=2352,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2348 /prefetch:8
        6⤵
        
        PID:3492
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3212 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3228
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3240 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3480
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4424,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4420 /prefetch:8
        6⤵
        
        PID:1444
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=4772,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4768 /prefetch:8
        6⤵
        
        PID:2184
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4928,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4924 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2092
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4900,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4896 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4676
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4868,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5284 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3576
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5044,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3284 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:3608
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5128,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5488 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1404
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=4876,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4944 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4696
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=3364,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3288 /prefetch:8
        6⤵
        
        PID:3932
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=3204,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3200 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1764
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5204,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3328 /prefetch:8
        6⤵
        
        PID:2256
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=renderer --string-annotations --noerrdialogs --enable-dinosaur-easter-egg-alt-images --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=4980,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5520 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:1412
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=3348,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5148 /prefetch:8
        6⤵
        
        PID:620
      - C:\Program Files\Google\Chrome\Application\Chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\Chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --field-trial-handle=5656,i,5016148264001796789,16618070915763636337,262144 --disable-features=PaintHolding --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5652 /prefetch:8
        6⤵
        
        PID:3608
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\mmxcqdbeypzvjdfogqjen"
        5⤵
        
        PID:1420
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\mmxcqdbeypzvjdfogqjen"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:2376
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\xgkvrnmxuxratjbsxbvfqtdw"
        5⤵
        Accesses Microsoft Outlook accounts
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\hipnrgxzifjfwypeglizbgyfveil"
        5⤵
        
        PID:2384
    - - C:\Windows\SysWOW64\recover.exe
        
        C:\Windows\SysWOW64\recover.exe /stext "C:\Users\Admin\AppData\Local\Temp\hipnrgxzifjfwypeglizbgyfveil"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1832
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData --headless --remote-debugging-port=9222 --profile-directory="Default"
        5⤵
        Uses browser remote debugging
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:3704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\TmpUserData /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\TmpUserData\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffec1adf208,0x7ffec1adf214,0x7ffec1adf220
        6⤵
        
        PID:2484
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --string-annotations --noerrdialogs --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1944,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
        6⤵
        
        PID:2672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2256,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
        6⤵
        
        PID:4176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=2656,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:8
        6⤵
        
        PID:4004
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --instant-process --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3548,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:4116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4356,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2704
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=4372,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --extension-process --renderer-sub-type=extension --remote-debugging-port=9222 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=4376,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
        6⤵
        Uses browser remote debugging
        
        PID:2708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --noerrdialogs --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=4664,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
        6⤵
        Uses browser remote debugging
        
        PID:2080
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5160,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4388,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
        6⤵
        
        PID:4036
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=4568,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
        6⤵
        
        PID:3504
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5400,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
        6⤵
        
        PID:3652
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5844,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
        6⤵
        
        PID:2240
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=5844,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
        6⤵
        
        PID:4572
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6160,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
        6⤵
        
        PID:3540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6268,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
        6⤵
        
        PID:2680
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6324,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
        6⤵
        
        PID:372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6412,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
        6⤵
        
        PID:2320
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6264,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
        6⤵
        
        PID:2568
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6308,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
        6⤵
        
        PID:3012
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6528,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
        6⤵
        
        PID:5296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --noerrdialogs --always-read-main-dll --field-trial-handle=6924,i,4058142526947583001,314569372494343127,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
        6⤵
        
        PID:5644
- C:\Windows\system32\cmd.exe
  cmd /c exit /b 0
  2⤵
  PID:4012

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Windows\System32\ieframe.dll",OpenURL C:\\ProgramData\\Dguhdowe.url
1⤵
- Checks computer location settings
PID:3576
- C:\Users\Admin\Links\Dguhdowe.PIF
  "C:\Users\Admin\Links\Dguhdowe.PIF"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- - C:\Windows\SysWOW64\SndVol.exe
    C:\Windows\System32\SndVol.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3648

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Windows\System32\ieframe.dll",OpenURL C:\\ProgramData\\Dguhdowe.url
1⤵
- Checks computer location settings
PID:6024
- C:\Users\Admin\Links\Dguhdowe.PIF
  "C:\Users\Admin\Links\Dguhdowe.PIF"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Authentication Process

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Query Registry

Remote System Discovery

T1018

System Information Discovery