hxxps://gofile[.]io/d/EDCgVR

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\System32\\userinit.exe,C:\\Windows\\Sub\\xdwdClient.exe"	Swift.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty"	WormLocker2.0.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Looks for VirtualBox Guest Additions in registry 2 TTPs 3 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	Swift.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	xdwdWatchDog.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	xdwdClient.exe

Renames multiple (61) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware
Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 1 IoCs

flow	pid	Process
83	1756	msedge.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	xdwdClient.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	Swift.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	xdwdWatchDog.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
1088	takeown.exe
2144	icacls.exe

Checks BIOS information in registry 2 TTPs 6 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Swift.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xdwdWatchDog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xdwdWatchDog.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xdwdClient.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xdwdClient.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	xdwdWatchDog.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	Swift.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	miockzds.rls.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\Control Panel\International\Geo\Nation	WormLocker2.0.exe

Executes dropped EXE 5 IoCs

pid	Process
4696	Swift.exe
3952	xdwdWatchDog.exe
4744	xdwdClient.exe
2964	miockzds.rls.exe
7096	WormLocker2.0.exe

Loads dropped DLL 64 IoCs

pid	Process
880	Process not Found
5432	Process not Found
4328	Process not Found
4812	WmiApSrv.exe
1480	Process not Found
1168	Process not Found
3952	xdwdWatchDog.exe
3780	Process not Found
3156	msedge.exe
3116	msedge.exe
3184	msedge.exe
3920	Process not Found
3128	Process not Found
732	Process not Found
4656	Process not Found
644	Process not Found
3924	Process not Found
4744	xdwdClient.exe
4860	Process not Found
4760	Process not Found
2720	Process not Found
956	Process not Found
3504	Process not Found
5524	Process not Found
3824	Process not Found
2524	Process not Found
5024	Process not Found
688	Process not Found
3068	Process not Found
3460	Process not Found
2412	powershell.exe
2964	miockzds.rls.exe
3300	Process not Found
2016	Process not Found
6036	Process not Found
4248	Process not Found
4568	manage-bde.exe
3584	Process not Found
5568	svchost.exe
3504	Process not Found
1540	BdeUISrv.exe
3272	FveNotify.exe
4224	Process not Found
1124	Process not Found
1828	cipher.exe
4060	Process not Found
4980	Process not Found
2984	ReAgentc.exe
5596	firefox.exe
5388	firefox.exe
5468	Process not Found
4376	vssadmin.exe
5212	firefox.exe
5484	vssvc.exe
3116	Process not Found
6708	Process not Found
7096	WormLocker2.0.exe
1540	Process not Found
6208	Process not Found
6260	taskmgr.exe
6528	Process not Found
6704	Process not Found
6608	WScript.exe
4500	AUDIODG.EXE

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1088	takeown.exe
2144	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xdwdfghfghfg = "C:\\Windows\\Sub\\xdwdWatchDog.exe"	Swift.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
33	api.gofile.io
34	api.gofile.io
35	api.gofile.io
340	pastebin.com
341	pastebin.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
346	icanhazip.com

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	Swift.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	Swift.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	xdwdWatchDog.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	xdwdWatchDog.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	xdwdClient.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	xdwdClient.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Start PowerShell.

execution

PowerShell

T1059.001

pid	Process
2412	powershell.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\WormLocker2.0.exe	miockzds.rls.exe
File created	C:\Windows\System32\LogonUItrue.exe	miockzds.rls.exe
File created	C:\Windows\System32\LogonUI.exe	miockzds.rls.exe
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\System32\LogonUIinf.exe	miockzds.rls.exe
File opened for modification	C:\Windows\System32\ransom_voice.vbs	miockzds.rls.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1644892221\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\gu\messages.json	msedge.exe
File opened for modification	C:\Windows\Sub\xdwdWatchDog.exe	Swift.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\fi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\id\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Sub\xdwdClient.exe	xdwdWatchDog.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1138955629\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_2053656657\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1598821005\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1369113792\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\manifest.fingerprint	msedge.exe
File created	C:\Windows\Sub\xdwdWatchDog.exe	Swift.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1598821005\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1644892221\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_635429946\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\my\messages.json	msedge.exe
File opened for modification	C:\Windows\Sub\xdwdClient.exe	xdwdClient.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_2053656657\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_2053656657\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1598821005\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1369113792\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1644892221\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4532_1138955629\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1644892221\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\kn\messages.json	msedge.exe
File opened for modification	C:\Windows\Sub	Swift.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5508_1598821005\manifest.fingerprint	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1248_831249104\_locales\zu\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
4376	vssadmin.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133880778202133925"	msedge.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{096E0268-204A-48FB-8C08-8CDD18526490}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{BAE5C2CE-D458-453D-A6C5-CC980F6153FB}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	xdwdWatchDog.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2123103809-19148277-2527443841-1000_Classes\Local Settings	WormLocker2.0.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2123103809-19148277-2527443841-1000\{948CA5BA-ACED-43E6-86D5-B13A74055C80}	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
1196	reg.exe
1472	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 40 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
732	schtasks.exe
6804	schtasks.exe
1472	schtasks.exe
5388	schtasks.exe
1036	schtasks.exe
2240	schtasks.exe
1540	schtasks.exe
1548	schtasks.exe
6044	schtasks.exe
2668	schtasks.exe
2664	schtasks.exe
1360	schtasks.exe
3256	schtasks.exe
5596	schtasks.exe
3704	schtasks.exe
2024	schtasks.exe
1992	schtasks.exe
6504	schtasks.exe
3968	schtasks.exe
4656	schtasks.exe
4404	schtasks.exe
2472	schtasks.exe
1756	schtasks.exe
2464	schtasks.exe
732	schtasks.exe
6240	schtasks.exe
4812	schtasks.exe
6888	schtasks.exe
6792	schtasks.exe
4236	schtasks.exe
4860	schtasks.exe
5888	schtasks.exe
4688	schtasks.exe
6568	schtasks.exe
3644	schtasks.exe
3760	schtasks.exe
2264	schtasks.exe
5400	schtasks.exe
6744	schtasks.exe
6772	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1680	7zFM.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
5508	msedge.exe
5508	msedge.exe

Suspicious use of AdjustPrivilegeToken 19 IoCs

description	pid	Process
Token: SeRestorePrivilege	1680	7zFM.exe
Token: 35	1680	7zFM.exe
Token: SeDebugPrivilege	5540	taskmgr.exe
Token: SeSystemProfilePrivilege	5540	taskmgr.exe
Token: SeCreateGlobalPrivilege	5540	taskmgr.exe
Token: SeDebugPrivilege	4696	Swift.exe
Token: SeDebugPrivilege	3952	xdwdWatchDog.exe
Token: SeDebugPrivilege	4744	xdwdClient.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeTakeOwnershipPrivilege	1088	takeown.exe
Token: SeDebugPrivilege	2964	miockzds.rls.exe
Token: SeBackupPrivilege	5484	vssvc.exe
Token: SeRestorePrivilege	5484	vssvc.exe
Token: SeAuditPrivilege	5484	vssvc.exe
Token: SeDebugPrivilege	5388	firefox.exe
Token: SeDebugPrivilege	5388	firefox.exe
Token: SeDebugPrivilege	7096	WormLocker2.0.exe
Token: 33	4500	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4500	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1680	7zFM.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
1248	msedge.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
5540	taskmgr.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe
4532	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5388	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1248 wrote to memory of 2624	1248	msedge.exe	84
PID 1248 wrote to memory of 2624	1248	msedge.exe	84
PID 1248 wrote to memory of 1756	1248	msedge.exe	85
PID 1248 wrote to memory of 1756	1248	msedge.exe	85
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 1556	1248	msedge.exe	86
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87
PID 1248 wrote to memory of 556	1248	msedge.exe	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://gofile.io/d/EDCgVR
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x290,0x7ffa053bf208,0x7ffa053bf214,0x7ffa053bf220
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=1980,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --subproc-heap-profiling --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2232,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=2444,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3524,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=5060,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=4844,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5288,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5596,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5668,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=5668,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6064,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=6104,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6076,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6476,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5896,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6924,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --video-capture-use-gpu-memory-buffer --string-annotations --subproc-heap-profiling --always-read-main-dll --field-trial-handle=6988,i,12733891205087025620,7824960500487469122,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Drops file in Windows directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x2cc,0x7ffa053bf208,0x7ffa053bf214,0x7ffa053bf220
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2236,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:2560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2556,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
    3⤵
    PID:5168
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4332,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
    3⤵
    PID:5456
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4332,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4508,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4784,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
    3⤵
    PID:5156
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4792,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5472,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5484,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:1288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6020,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
    3⤵
    PID:5616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=5868,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
    3⤵
    PID:5176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=5860,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
    3⤵
    PID:1336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=5988,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=7056,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
    3⤵
    PID:2732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6832,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6636,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:8
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5672,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5048,i,3319072476165333679,2918354770134666703,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
    3⤵
    - Drops file in Windows directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:5508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffa053bf208,0x7ffa053bf214,0x7ffa053bf220
      4⤵
      PID:5396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1896,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      PID:2580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2308,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:5816
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2372,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:8
      4⤵
      PID:2620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4248,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
      4⤵
      PID:3236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4488,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
      4⤵
      PID:5296
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4488,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
      4⤵
      PID:2288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4640,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=4672 /prefetch:1
      4⤵
      PID:4728
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4976,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      PID:4740
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4292,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
      4⤵
      PID:5424
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5396,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:1
      4⤵
      PID:1600
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=604,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
      4⤵
      Loads dropped DLL
      PID:3156
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5756,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
      4⤵
      Loads dropped DLL
      PID:3116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5820,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:8
      4⤵
      Loads dropped DLL
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5884,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
      4⤵
      PID:760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5184,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
      4⤵
      PID:5376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5940,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
      4⤵
      PID:6140
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
      4⤵
      PID:6544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5052,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
      4⤵
      PID:4432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5284,i,6920964938061681248,8807775465035364022,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
      4⤵
      PID:6816

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:4860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:5500

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3840

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Swift.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1680

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  PID:4048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
  2⤵
  PID:4680

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:880

C:\Users\Admin\Downloads\Swift.exe
"C:\Users\Admin\Downloads\Swift.exe"
1⤵
- Modifies WinLogon for persistence
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Maps connected drives based on registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4696
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe" & exit
  2⤵
  PID:3256
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "USER OOBE BROKER" /tr "C:\Windows\Sub\xdwdClient.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1124
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1540
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdhuitebeaneratnik" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST & exit
  2⤵
  PID:2516
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo 5 /tn "xdwdhuitebeaneratnik" /tr "C:\Windows\Sub\xdwdWatchDog.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4656
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4200
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2964
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4860
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2592
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3960
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3760
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2132
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6044
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3256
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4752
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3704
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3820
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2264
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:5188
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5400
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3712
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4680
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2668
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3472
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2664
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4420
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2464
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4596
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /b powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\miockzds.rls.exe"' & exit
  2⤵
  PID:3820
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell –ExecutionPolicy Bypass Start-Process -FilePath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\miockzds.rls.exe"'
    3⤵
    - Loads dropped DLL
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2412
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\miockzds.rls.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\miockzds.rls.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in System32 directory
      Suspicious use of AdjustPrivilegeToken
      PID:2964
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
        5⤵
        
        PID:2416
      - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\System32
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1088
      - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\System32 /grant "Admin:F"
        6⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2144
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg add HKLM\SOFTWARE\Policies\Microsoft\FVE /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f
        5⤵
        
        PID:2752
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\FVE /v EnableBDEWithNoTPM /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:1196
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reg add HKLM\SOFTWARE\Policies\Microsoft\FVE /v UseAdvancedStartup /t REG_DWORD /d 1 /f
        5⤵
        
        PID:5888
      - C:\Windows\system32\reg.exe
        
        reg add HKLM\SOFTWARE\Policies\Microsoft\FVE /v UseAdvancedStartup /t REG_DWORD /d 1 /f
        6⤵
        Modifies registry key
        
        PID:1472
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C manage-bde -on C: -pw -rk C:\key.bin
        5⤵
        
        PID:5976
      - C:\Windows\system32\manage-bde.exe
        
        manage-bde -on C: -pw -rk C:\key.bin
        6⤵
        Loads dropped DLL
        
        PID:4568
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C cipher /w:C:\key.bin
        5⤵
        
        PID:3160
      - C:\Windows\system32\cipher.exe
        
        cipher /w:C:\key.bin
        6⤵
        Loads dropped DLL
        
        PID:1828
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C reagentc /disable && vssadmin delete shadows /all /quiet
        5⤵
        
        PID:4976
      - C:\Windows\system32\ReAgentc.exe
        
        reagentc /disable
        6⤵
        Loads dropped DLL
        Drops file in System32 directory
        
        PID:2984
      - C:\Windows\system32\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        6⤵
        Loads dropped DLL
        Interacts with shadow copies
        
        PID:4376
    - - C:\Windows\System32\WormLocker2.0.exe
        
        "C:\Windows\System32\WormLocker2.0.exe"
        5⤵
        Modifies WinLogon for persistence
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        
        PID:7096
      - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Windows\System32\ransom_voice.vbs"
        6⤵
        Loads dropped DLL
        
        PID:6608
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2772
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4236
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:5080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1992
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3092
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:732
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:1072
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1036
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4784
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6200
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6240
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6524
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6568
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6696
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6804
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6844
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3644
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:7080
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1472
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:2952
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6504
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:3828
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3968
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:7048
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6548
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6744
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:5512
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6528
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6772
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:4196
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6888
- C:\Windows\SYSTEM32\CMD.exe
  "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
  2⤵
  PID:6992
- - C:\Windows\system32\schtasks.exe
    SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6792

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Windows\Sub\xdwdWatchDog.exe
1⤵
PID:1012
- C:\Windows\Sub\xdwdWatchDog.exe
  C:\Windows\Sub\xdwdWatchDog.exe
  2⤵
  - Looks for VirtualBox Guest Additions in registry
  - Looks for VMWare Tools registry key
  - Checks BIOS information in registry
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Maps connected drives based on registry
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3952
- - C:\Windows\system32\CMD.exe
    "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
    3⤵
    PID:5500
  - - C:\Windows\system32\schtasks.exe
      SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5596
- - C:\Windows\Sub\xdwdClient.exe
    "C:\Windows\Sub\xdwdClient.exe"
    3⤵
    - Looks for VirtualBox Guest Additions in registry
    - Looks for VMWare Tools registry key
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Maps connected drives based on registry
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4744
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      4⤵
      PID:3160
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1360
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      4⤵
      PID:1828
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:4688
  - - C:\Windows\system32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST & exit
      4⤵
      PID:4976
    - - C:\Windows\system32\schtasks.exe
        
        SchTaSKs /create /f /sc minute /mo -1 /tn "XDWDidinaxui" /tr "C:\Windows\Sub\xdwdClient.exe" /RL HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:2024

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Loads dropped DLL
PID:4812

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
- Loads dropped DLL
PID:5568

C:\Windows\System32\BdeUISrv.exe
C:\Windows\System32\BdeUISrv.exe -Embedding
1⤵
- Loads dropped DLL
PID:1540

C:\Windows\System32\FveNotify.exe
"C:\Windows\System32\FveNotify.exe" \\?\Volume{4b4f6944-0000-0000-0000-d08302000000}\
1⤵
- Loads dropped DLL
PID:3272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Loads dropped DLL
PID:5596
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Loads dropped DLL
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27100 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2084 -initialChannelId {fa6f3412-6dac-49a9-927b-4a9344195aa7} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    - Loads dropped DLL
    PID:5212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2444 -prefsLen 27136 -prefMapHandle 2448 -prefMapSize 270279 -ipcHandle 2456 -initialChannelId {40c457b3-7eba-4793-afff-a1503f4bc007} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3792 -prefsLen 27277 -prefMapHandle 3796 -prefMapSize 270279 -jsInitHandle 3800 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3808 -initialChannelId {62eb48cf-db43-4d52-a58c-175d6b85369a} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3952 -prefsLen 27277 -prefMapHandle 3956 -prefMapSize 270279 -ipcHandle 4056 -initialChannelId {504f99ca-c604-43ef-bef8-da05fe6e1d12} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:3004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1040 -prefsLen 34776 -prefMapHandle 3380 -prefMapSize 270279 -jsInitHandle 884 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1036 -initialChannelId {982b5445-ecfc-459d-b570-0db1cdecc520} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:5024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4984 -prefsLen 35013 -prefMapHandle 4988 -prefMapSize 270279 -ipcHandle 4996 -initialChannelId {8a0cd3c8-b5a0-483c-bb81-ff6c8f38fdee} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:6920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4764 -prefsLen 32952 -prefMapHandle 4780 -prefMapSize 270279 -jsInitHandle 4792 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {6eb1aecc-b075-489c-a07c-759a0781297b} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:6800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2840 -prefsLen 32952 -prefMapHandle 2964 -prefMapSize 270279 -jsInitHandle 3256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3356 -initialChannelId {7aa7ee00-736c-4e01-a4e2-974d11458626} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:6320
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5568 -prefsLen 32952 -prefMapHandle 5572 -prefMapSize 270279 -jsInitHandle 5576 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {e4b36c49-c6ab-4810-90a4-22959acceb0f} -parentPid 5388 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5388" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:6812

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Loads dropped DLL
PID:6260

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x45c 0x2f4
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion