hxxp://google[.]com

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Modifies visibility of file extensions in Explorer 2 TTPs 10 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	reg.exe

UAC bypass 3 TTPs 10 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	reg.exe

Renames multiple (98) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\Control Panel\International\Geo\Nation	XmIgAcsg.exe

Executes dropped EXE 64 IoCs

pid	Process
5964	smEIksAs.exe
2520	XmIgAcsg.exe
1976	smEIksAs.exe
4240	XmIgAcsg.exe
5060	smEIksAs.exe
2756	XmIgAcsg.exe
5616	smEIksAs.exe
4532	XmIgAcsg.exe
1768	smEIksAs.exe
3416	XmIgAcsg.exe
2124	smEIksAs.exe
2564	XmIgAcsg.exe
4752	XmIgAcsg.exe
2572	smEIksAs.exe
1376	[email protected]
5864	XmIgAcsg.exe
5376	smEIksAs.exe
4904	XmIgAcsg.exe
6132	[email protected]
1640	smEIksAs.exe
6312	XmIgAcsg.exe
6340	smEIksAs.exe
6388	XmIgAcsg.exe
6432	[email protected]
6464	smEIksAs.exe
6732	XmIgAcsg.exe
6852	smEIksAs.exe
6860	XmIgAcsg.exe
6920	smEIksAs.exe
7156	[email protected]
7376	XmIgAcsg.exe
7404	[email protected]
7412	XmIgAcsg.exe
7420	smEIksAs.exe
7472	smEIksAs.exe
8184	XmIgAcsg.exe
6952	XmIgAcsg.exe
4472	smEIksAs.exe
7124	[email protected]
6396	smEIksAs.exe
6168	XmIgAcsg.exe
7116	smEIksAs.exe
7388	smEIksAs.exe
7880	[email protected]
6644	XmIgAcsg.exe
8304	XmIgAcsg.exe
8508	XmIgAcsg.exe
8580	smEIksAs.exe
8676	smEIksAs.exe
8344	XmIgAcsg.exe
8120	XmIgAcsg.exe
8832	smEIksAs.exe
8812	smEIksAs.exe
1788	XmIgAcsg.exe
8456	XmIgAcsg.exe
8468	smEIksAs.exe
6448	smEIksAs.exe
7744	XmIgAcsg.exe
8388	XmIgAcsg.exe
8340	smEIksAs.exe
8372	smEIksAs.exe
9096	XmIgAcsg.exe
9268	smEIksAs.exe
9260	smEIksAs.exe

Loads dropped DLL 16 IoCs

pid	Process
3916	[email protected]
3916	[email protected]
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
3236	MsiExec.exe
5720	MsiExec.exe
3236	MsiExec.exe
3916	[email protected]
3236	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 59 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\XmIgAcsg.exe = "C:\\ProgramData\\TqgEwQEg\\XmIgAcsg.exe"	XmIgAcsg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\smEIksAs.exe = "C:\\Users\\Admin\\lmockcgg\\smEIksAs.exe"	smEIksAs.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
207	3236	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
197	raw.githubusercontent.com
198	raw.githubusercontent.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\MYYS.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\gEca.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\cIQi.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\yEAu.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\eUUg.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\Qsss.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\MEIM.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\gAUO.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\CIYo.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\OcgC.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\oAsa.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\IcAG.ico	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\owsO.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\cEQA.ico	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\gIsS.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\ygMw.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\MIsS.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\YokA.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\YcEK.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\MEIM.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\wEce.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\WIUA.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\qwoo.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\KcMa.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\cokk.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\MQYW.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\GcAW.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\ugwm.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\cEwU.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\cswy.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\EoAU.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\eksC.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\sEQY.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\CMgk.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\qQQm.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\YYoO.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\qosI.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\eksC.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\acoe.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\gYUk.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\SQEK.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\kIoO.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\yggI.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\AIAs.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\mgUE.ico	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\owUs.ico	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\AoQK.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\iUMi.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\sYMo.ico	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\iEwQ.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\Awce.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\gMcC.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\QgUq.ico	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\CUQk.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\IUkS.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\SkQY.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\Gcgm.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\AwAq.ico	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\wsMu.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\coEu.exe	XmIgAcsg.exe
File opened for modification	C:\Windows\SysWOW64\qUMm.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\mEoG.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\SAIq.exe	XmIgAcsg.exe
File created	C:\Windows\SysWOW64\EAYc.exe	XmIgAcsg.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI86F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI82C3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI854A.tmp	msiexec.exe
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI84FB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85BB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8669.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8331.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI855B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI858B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI860A.tmp	msiexec.exe
File created	C:\Windows\Installer\e598246.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e598246.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI83BF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI841D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI845D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI849C.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	XmIgAcsg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	smEIksAs.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133882489543474886"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-446031748-3036493239-2009529691-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Modifies registry key 1 TTPs 30 IoCs

Modify Registry

pid	Process
5112	reg.exe
1812	reg.exe
5800	reg.exe
7880	reg.exe
7540	reg.exe
7544	reg.exe
7332	reg.exe
2540	reg.exe
5488	reg.exe
5432	reg.exe
6244	reg.exe
1108	reg.exe
3816	reg.exe
7888	reg.exe
3412	reg.exe
1220	reg.exe
1788	reg.exe
3640	reg.exe
1444	reg.exe
6824	reg.exe
3212	reg.exe
992	reg.exe
3564	reg.exe
5748	reg.exe
5540	reg.exe
6756	reg.exe
7872	reg.exe
7744	reg.exe
3212	reg.exe
2044	reg.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
3136	chrome.exe
3136	chrome.exe
540	msiexec.exe
540	msiexec.exe
3068	[email protected]
3068	[email protected]
3068	[email protected]
3068	[email protected]
6056	[email protected]
6056	[email protected]
6056	[email protected]
6056	[email protected]
5352	[email protected]
5352	[email protected]
5352	[email protected]
5352	[email protected]
1376	[email protected]
1376	[email protected]
1376	[email protected]
1376	[email protected]
6132	[email protected]
6132	[email protected]
6132	[email protected]
6132	[email protected]
6432	[email protected]
6432	[email protected]
6432	[email protected]
6432	[email protected]
7156	[email protected]
7156	[email protected]
7156	[email protected]
7156	[email protected]
7404	[email protected]
7404	[email protected]
7404	[email protected]
7404	[email protected]
7124	[email protected]
7124	[email protected]
7124	[email protected]
7124	[email protected]
7880	[email protected]
7880	[email protected]
7880	[email protected]
7880	[email protected]

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe
Token: SeShutdownPrivilege	4352	chrome.exe
Token: SeCreatePagefilePrivilege	4352	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
3816	msiexec.exe
3816	msiexec.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
2520	XmIgAcsg.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe
4352	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4336	ScreenSketch.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 4420	4352	chrome.exe	86
PID 4352 wrote to memory of 4420	4352	chrome.exe	86
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 3632	4352	chrome.exe	87
PID 4352 wrote to memory of 5024	4352	chrome.exe	88
PID 4352 wrote to memory of 5024	4352	chrome.exe	88
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89
PID 4352 wrote to memory of 4484	4352	chrome.exe	89

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff8b10dcf8,0x7fff8b10dd04,0x7fff8b10dd10
  2⤵
  PID:4420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1768,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=1764 /prefetch:2
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1508,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  PID:5024
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2344,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=2428 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3092,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3096,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4388,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4408 /prefetch:2
  2⤵
  PID:1396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4372,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5208,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5280,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5632,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5800,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4576,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4748 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4784,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4756,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5604,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:6068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=4436,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=6008,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5828,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4488,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5804,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=984,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5768,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6404,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5860,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6132,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=6508,i,17868298131493078003,6917308914195360955,262144 --variations-seed-version=20250314-050508.937000 --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:6164

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3420

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4004

C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
PID:3916
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\[email protected] SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod.zip\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - Suspicious use of FindShellTrayWindow
  PID:3816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:540
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding A15CF50AF874F68979CB7434B99BA963
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  PID:3236
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 404256249761F5698F3F0622159E7859 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:5720

C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:3068
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  "C:\Users\Admin\lmockcgg\smEIksAs.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5964
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  "C:\ProgramData\TqgEwQEg\XmIgAcsg.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of FindShellTrayWindow
  PID:2520
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
  2⤵
  PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
    C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:6056
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2568
    - - C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:5352
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        6⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        7⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1376
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6132
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        10⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        11⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:6432
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        13⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:7156
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        15⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7404
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        17⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7124
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        18⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]
        
        C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom
        19⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:7880
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\Endermanch@PolyRansom"
        20⤵
        
        PID:7540
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        20⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:7332
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        20⤵
        Modifies registry key
        
        PID:6244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        20⤵
        UAC bypass
        Modifies registry key
        
        PID:3212
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\oQwkooYo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        20⤵
        
        PID:6824
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        21⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        18⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:7544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        18⤵
        Modifies registry key
        
        PID:7744
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        18⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:7540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\BCMAkIQo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        18⤵
        
        PID:7536
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        19⤵
        
        PID:7560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        16⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:7872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        16⤵
        Modifies registry key
        
        PID:7880
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        16⤵
        UAC bypass
        Modifies registry key
        
        PID:7888
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\icQYAkoo.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        16⤵
        System Location Discovery: System Language Discovery
        
        PID:7904
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        17⤵
        
        PID:6196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        14⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        14⤵
        Modifies registry key
        
        PID:6824
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        14⤵
        UAC bypass
        Modifies registry key
        
        PID:6756
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dAUQQEEw.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        14⤵
        System Location Discovery: System Language Discovery
        
        PID:6216
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        15⤵
        
        PID:7508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        12⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3640
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        12⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        12⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5800
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\YasIwgcg.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        12⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        13⤵
        
        PID:7520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        10⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:1788
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        10⤵
        Modifies registry key
        
        PID:992
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        10⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3816
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\QcMksUMU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:6452
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        8⤵
        Modifies visibility of file extensions in Explorer
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:3412
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        8⤵
        Modifies registry key
        
        PID:1812
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        8⤵
        UAC bypass
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5540
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\IssgIAcc.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:992
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        9⤵
        
        PID:2540
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
        6⤵
        Modifies visibility of file extensions in Explorer
        Modifies registry key
        
        PID:3564
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
        6⤵
        System Location Discovery: System Language Discovery
        Modifies registry key
        
        PID:5432
      - C:\Windows\SysWOW64\reg.exe
        
        reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
        6⤵
        UAC bypass
        Modifies registry key
        
        PID:1108
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\XwkoYcgs.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
        6⤵
        
        PID:3924
        
        C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        7⤵
        
        PID:6104
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
      4⤵
      Modifies visibility of file extensions in Explorer
      Modifies registry key
      PID:1220
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5488
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
      4⤵
      UAC bypass
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:5112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\vUUAoIIk.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
      4⤵
      System Location Discovery: System Language Discovery
      PID:3396
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
        5⤵
        
        PID:2896
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v HideFileExt /t REG_DWORD /d 1
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies registry key
  PID:2540
- C:\Windows\SysWOW64\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /f /v Hidden /t REG_DWORD /d 2
  2⤵
  - Modifies registry key
  PID:1444
- C:\Windows\SysWOW64\reg.exe
  reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /d 0 /t REG_DWORD /f
  2⤵
  - UAC bypass
  - Modifies registry key
  PID:2044
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\dmEQIYEU.bat" "C:\Users\Admin\AppData\Local\Temp\Temp1_PolyRansom.zip\[email protected]""
  2⤵
  PID:5204
- - C:\Windows\SysWOW64\cscript.exe
    cscript C:\Users\Admin\AppData\Local\Temp/file.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4664

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:1904
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:3848
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4240

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:744
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:2756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:4768
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:4584
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5616

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:668
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:3484
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1768

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:4044
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:1368
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:4036
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:3956
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:4916
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2572

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:5720
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4904

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:5904
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:1220
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:3748
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:4868
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:5992
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:5448
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:3952
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:6516
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6732

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:6648
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6860

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:6656
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:6804
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:6256
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:7420

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:6676
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:6796
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:6832
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:7376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7628
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6952

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7640
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:7728
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:7852
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:4472

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7304
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6168

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:7308
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:7104
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7360
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:6644

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:7656
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:7116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:3640
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:7392
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8028
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8676

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7432
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:8436
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:8692
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8816
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8892
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8832

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:6244
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:1788

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:8792
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:9188
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8468

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:9208
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:6448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:8884
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:7744

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:9168
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:8388

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8056
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8340

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8228
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:8372

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7052
- C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\ProgramData\TqgEwQEg\XmIgAcsg.exe
1⤵
PID:7032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8320
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:9260

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\lmockcgg\smEIksAs.exe
1⤵
PID:8300
- C:\Users\Admin\lmockcgg\smEIksAs.exe
  C:\Users\Admin\lmockcgg\smEIksAs.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  PID:9268

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\388f93c93fb245a2a8658285b5168cc0 /t 4308 /p 4352
1⤵
PID:10228

C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe
"C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe" -ServerName:App.AppX4k4k4wd0fmhfvg9v37catz0s8k6m08gh.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:4336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery