amadey | 370d9f85a3cd1dfc33df7de053a269d9d3c62b84e0f939180e3fbb7e8e12b574

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	on6jPp6S.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
88	3572	Process not Found
93	3572	Process not Found
97	3572	Process not Found
104	3572	Process not Found
109	3572	Process not Found

Downloads MZ/PE file 15 IoCs

flow	pid	Process
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q
44	2964	2jq4GUd2.sBm5q

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	on6jPp6S.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	on6jPp6S.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Control Panel\International\Geo\Nation	2jq4GUd2.sBm5q

Executes dropped EXE 14 IoCs

pid	Process
3792	CXvDjB3J.exe
2964	2jq4GUd2.sBm5q
4384	on6jPp6S.exe
3900	CXvDjB3J.exe
3400	QL2M7cr.exe
5828	CXvDjB3J.exe
3140	5d80d4c381.exe
5448	CXvDjB3J.exe
5488	CXvDjB3J.exe
2684	L6qQkwT.exe
2232	CXvDjB3J.exe
4548	AeeL4rc.exe
2748	CXvDjB3J.exe
3440	IfKyM0a.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1419306801-3438187156-704942707-1000\Software\Wine	on6jPp6S.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3540	icacls.exe
5516	icacls.exe
3156	icacls.exe
1724	icacls.exe
4884	icacls.exe
4848	icacls.exe
3180	icacls.exe
3020	icacls.exe
3376	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\CXvDjB3J.exe	D5848832B09FD4445D2E2A00EA9F2500.exe
File opened for modification	C:\Windows\SysWOW64\CXvDjB3J.exe	D5848832B09FD4445D2E2A00EA9F2500.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4384	on6jPp6S.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3140 set thread context of 184	3140	5d80d4c381.exe	179

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4948	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 31 IoCs

pid	pid_target	Process	procid_target
2936	3792	WerFault.exe	121
2504	3900	WerFault.exe	139
3688	5828	WerFault.exe	158
4012	5448	WerFault.exe	172
6028	5488	WerFault.exe	183
3540	2684	WerFault.exe	185
212	2232	WerFault.exe	199
1268	2684	WerFault.exe	185
1632	2748	WerFault.exe	216
5716	1012	WerFault.exe	232
5516	3296	WerFault.exe	239
5948	5452	WerFault.exe	246
6644	6576	WerFault.exe	251
7128	7084	WerFault.exe	258
6436	6280	WerFault.exe	265
1880	4128	WerFault.exe	277
6948	6892	WerFault.exe	284
432	6300	WerFault.exe	297
5400	3832	WerFault.exe	305
4772	808	WerFault.exe	318
5100	5820	WerFault.exe	331
772	4316	WerFault.exe	321
6832	536	WerFault.exe	345
5244	4316	WerFault.exe	321
5572	3844	WerFault.exe	352
6276	2840	WerFault.exe	367
5932	5188	WerFault.exe	373
3184	6432	WerFault.exe	385
560	1436	WerFault.exe	398
6768	6516	WerFault.exe	410
3908	6668	WerFault.exe	425

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2jq4GUd2.sBm5q
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QL2M7cr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	L6qQkwT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5848832B09FD4445D2E2A00EA9F2500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D5848832B09FD4445D2E2A00EA9F2500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	on6jPp6S.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133992237614826014"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
3580	schtasks.exe
5336	schtasks.exe
3572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4948	powershell.exe
4948	powershell.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
1044	chrome.exe
1044	chrome.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4768	chrome.exe
4768	chrome.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
3400	QL2M7cr.exe
3400	QL2M7cr.exe
3400	QL2M7cr.exe
184	MSBuild.exe
184	MSBuild.exe
184	MSBuild.exe
184	MSBuild.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
2684	L6qQkwT.exe
2684	L6qQkwT.exe
2684	L6qQkwT.exe
2684	L6qQkwT.exe
5348	chrome.exe
5348	chrome.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe
4384	on6jPp6S.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
5348	chrome.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of AdjustPrivilegeToken 59 IoCs

description	pid	Process
Token: SeDebugPrivilege	1492	D5848832B09FD4445D2E2A00EA9F2500.exe
Token: SeRestorePrivilege	3540	icacls.exe
Token: SeRestorePrivilege	3180	icacls.exe
Token: SeDebugPrivilege	4948	powershell.exe
Token: SeDebugPrivilege	4680	D5848832B09FD4445D2E2A00EA9F2500.exe
Token: SeRestorePrivilege	1724	icacls.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeDebugPrivilege	3400	QL2M7cr.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	1044	chrome.exe
Token: SeCreatePagefilePrivilege	1044	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	4768	chrome.exe
Token: SeCreatePagefilePrivilege	4768	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeImpersonatePrivilege	4384	on6jPp6S.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeDebugPrivilege	3440	IfKyM0a.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe
Token: SeShutdownPrivilege	5348	chrome.exe
Token: SeCreatePagefilePrivilege	5348	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
1044	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe
4768	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2724	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	82
PID 1492 wrote to memory of 2724	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	82
PID 1492 wrote to memory of 2724	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	82
PID 2724 wrote to memory of 3540	2724	cmd.exe	84
PID 2724 wrote to memory of 3540	2724	cmd.exe	84
PID 2724 wrote to memory of 3540	2724	cmd.exe	84
PID 1492 wrote to memory of 3472	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	85
PID 1492 wrote to memory of 3472	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	85
PID 1492 wrote to memory of 3472	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	85
PID 3472 wrote to memory of 5516	3472	cmd.exe	87
PID 3472 wrote to memory of 5516	3472	cmd.exe	87
PID 3472 wrote to memory of 5516	3472	cmd.exe	87
PID 1492 wrote to memory of 6104	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	88
PID 1492 wrote to memory of 6104	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	88
PID 1492 wrote to memory of 6104	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	88
PID 6104 wrote to memory of 4848	6104	cmd.exe	90
PID 6104 wrote to memory of 4848	6104	cmd.exe	90
PID 6104 wrote to memory of 4848	6104	cmd.exe	90
PID 1492 wrote to memory of 4176	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	91
PID 1492 wrote to memory of 4176	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	91
PID 1492 wrote to memory of 4176	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	91
PID 4176 wrote to memory of 3180	4176	cmd.exe	93
PID 4176 wrote to memory of 3180	4176	cmd.exe	93
PID 4176 wrote to memory of 3180	4176	cmd.exe	93
PID 1492 wrote to memory of 2976	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	94
PID 1492 wrote to memory of 2976	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	94
PID 1492 wrote to memory of 2976	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	94
PID 2976 wrote to memory of 3020	2976	cmd.exe	96
PID 2976 wrote to memory of 3020	2976	cmd.exe	96
PID 2976 wrote to memory of 3020	2976	cmd.exe	96
PID 1492 wrote to memory of 228	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	97
PID 1492 wrote to memory of 228	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	97
PID 1492 wrote to memory of 228	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	97
PID 228 wrote to memory of 3156	228	cmd.exe	99
PID 228 wrote to memory of 3156	228	cmd.exe	99
PID 228 wrote to memory of 3156	228	cmd.exe	99
PID 1492 wrote to memory of 5524	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	100
PID 1492 wrote to memory of 5524	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	100
PID 1492 wrote to memory of 5524	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	100
PID 5524 wrote to memory of 4948	5524	cmd.exe	102
PID 5524 wrote to memory of 4948	5524	cmd.exe	102
PID 5524 wrote to memory of 4948	5524	cmd.exe	102
PID 1492 wrote to memory of 4824	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	107
PID 1492 wrote to memory of 4824	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	107
PID 1492 wrote to memory of 4824	1492	D5848832B09FD4445D2E2A00EA9F2500.exe	107
PID 4824 wrote to memory of 4540	4824	cmd.exe	109
PID 4824 wrote to memory of 4540	4824	cmd.exe	109
PID 4824 wrote to memory of 4540	4824	cmd.exe	109
PID 4540 wrote to memory of 4644	4540	net.exe	110
PID 4540 wrote to memory of 4644	4540	net.exe	110
PID 4540 wrote to memory of 4644	4540	net.exe	110
PID 4680 wrote to memory of 4744	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	112
PID 4680 wrote to memory of 4744	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	112
PID 4680 wrote to memory of 4744	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	112
PID 4744 wrote to memory of 1724	4744	cmd.exe	114
PID 4744 wrote to memory of 1724	4744	cmd.exe	114
PID 4744 wrote to memory of 1724	4744	cmd.exe	114
PID 4680 wrote to memory of 4608	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	115
PID 4680 wrote to memory of 4608	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	115
PID 4680 wrote to memory of 4608	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	115
PID 4608 wrote to memory of 3376	4608	cmd.exe	117
PID 4608 wrote to memory of 3376	4608	cmd.exe	117
PID 4608 wrote to memory of 3376	4608	cmd.exe	117
PID 4680 wrote to memory of 5792	4680	D5848832B09FD4445D2E2A00EA9F2500.exe	118

C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe
"C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /setowner "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3540
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3472
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:5516
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /remove:d Everyone Administrators
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4848
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /setowner "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4176
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:3180
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /remove:d Everyone Administrators
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\Desktop\on6jPp6S.exe" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3156
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe" -StartupType Automatic"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5524
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -ExecutionPolicy Bypass -Command "New-Service -Name "DownloaderService" -BinaryPathName "C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe" -StartupType Automatic"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4948
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c net start "DownloaderService"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4824
- - C:\Windows\SysWOW64\net.exe
    net start "DownloaderService"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start "DownloaderService"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4644
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c schtasks /create /tn "P6CeWpGv" /xml "C:\Users\Admin\AppData\Local\Temp\P6CeWpGv.xml" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2240
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "P6CeWpGv" /xml "C:\Users\Admin\AppData\Local\Temp\P6CeWpGv.xml" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3580
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3544
- - C:\Users\Admin\Desktop\2jq4GUd2.sBm5q
    "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
    3⤵
    - Downloads MZ/PE file
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2964
  - - C:\Users\Admin\AppData\Local\Temp\10357140101\QL2M7cr.exe
      "C:\Users\Admin\AppData\Local\Temp\10357140101\QL2M7cr.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3400
  - - C:\Users\Admin\AppData\Local\Temp\10359300101\5d80d4c381.exe
      "C:\Users\Admin\AppData\Local\Temp\10359300101\5d80d4c381.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3140
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:5524
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:184
  - - C:\Users\Admin\AppData\Local\Temp\10365170101\L6qQkwT.exe
      "C:\Users\Admin\AppData\Local\Temp\10365170101\L6qQkwT.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:2684
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1700
        5⤵
        Program crash
        
        PID:3540
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 1672
        5⤵
        Program crash
        
        PID:1268
  - - C:\Users\Admin\AppData\Local\Temp\10366460101\AeeL4rc.exe
      "C:\Users\Admin\AppData\Local\Temp\10366460101\AeeL4rc.exe"
      4⤵
      Executes dropped EXE
      PID:4548
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\10367590101\IfKyM0a.exe
      "C:\Users\Admin\AppData\Local\Temp\10367590101\IfKyM0a.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3440
    - - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:5336
    - - C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
        
        "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
        5⤵
        
        PID:2724
      - C:\Windows\SYSTEM32\schtasks.exe
        
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        6⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3572
  - - C:\Users\Admin\AppData\Local\Temp\10368680101\OtoCzBd.exe
      "C:\Users\Admin\AppData\Local\Temp\10368680101\OtoCzBd.exe"
      4⤵
      PID:3876
    - - C:\Windows\HelpPane.exe
        
        C:\\Windows\\HelpPane.exe
        5⤵
        
        PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\10370560101\xQvtpl8.exe
      "C:\Users\Admin\AppData\Local\Temp\10370560101\xQvtpl8.exe"
      4⤵
      PID:1208
    - - C:\Windows\HelpPane.exe
        
        C:\Windows\HelpPane.exe
        5⤵
        
        PID:6184
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:4660
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4948
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:5756
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3744
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:6744
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:6120
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6212
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:6980
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:4056
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6888
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:7036
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:4308
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:4624
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1752,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
        7⤵
        
        PID:2328
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2432,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
        7⤵
        
        PID:5764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2052,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
        7⤵
        
        PID:5912
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3216,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:1
        7⤵
        
        PID:1028
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3224,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
        7⤵
        
        PID:3176
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4312,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
        7⤵
        
        PID:2140
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4704,i,5032654381049143274,6727154345269175444,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
        7⤵
        
        PID:3924
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff80f0cf208,0x7ff80f0cf214,0x7ff80f0cf220
        7⤵
        
        PID:5568
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1888,i,16812212110995350549,8958454162423593879,262144 --variations-seed-version --mojo-platform-channel-handle=2804 /prefetch:3
        7⤵
        
        PID:1904
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2764,i,16812212110995350549,8958454162423593879,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:2
        7⤵
        
        PID:5888
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1828,i,16812212110995350549,8958454162423593879,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
        7⤵
        
        PID:1544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3540,i,16812212110995350549,8958454162423593879,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
        7⤵
        
        PID:3572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3560,i,16812212110995350549,8958454162423593879,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
        7⤵
        
        PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\10373150101\92d0e0506e.exe
      "C:\Users\Admin\AppData\Local\Temp\10373150101\92d0e0506e.exe"
      4⤵
      PID:6796
    - - C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost015.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\10373160101\c114a44ff5.exe
      "C:\Users\Admin\AppData\Local\Temp\10373160101\c114a44ff5.exe"
      4⤵
      PID:5948
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:2496
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:5604
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6064
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:1436
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:5440
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0x8,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:3896
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2268
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:4772
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1924,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
        7⤵
        
        PID:4544
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2552,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
        7⤵
        
        PID:4424
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2040,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:8
        7⤵
        
        PID:1880
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3196,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=3208 /prefetch:1
        7⤵
        
        PID:1596
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3216,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:1
        7⤵
        
        PID:3784
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4252,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
        7⤵
        
        PID:4684
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3176,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
        7⤵
        
        PID:908
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=2564,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:3
        7⤵
        
        PID:5764
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5540,i,1920969910383747157,12440672932202579352,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:8
        7⤵
        
        PID:4072
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2008
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:7108
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:2788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x334,0x7ff80f0cf208,0x7ff80f0cf214,0x7ff80f0cf220
        7⤵
        
        PID:6552
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:3
        7⤵
        
        PID:2388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2564,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:2
        7⤵
        
        PID:4676
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1900,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
        7⤵
        
        PID:844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3420,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        7⤵
        
        PID:6556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3428,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        7⤵
        
        PID:832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5020,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
        7⤵
        
        PID:4544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4880,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
        7⤵
        
        PID:2488
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5024,i,5300149661813152466,17634503762420579917,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
        7⤵
        
        PID:3956
  - - C:\Users\Admin\AppData\Local\Temp\10373170101\OtoCzBd.exe
      "C:\Users\Admin\AppData\Local\Temp\10373170101\OtoCzBd.exe"
      4⤵
      PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\10373180101\1wbVZkk.exe
      "C:\Users\Admin\AppData\Local\Temp\10373180101\1wbVZkk.exe"
      4⤵
      PID:6008
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c cmd < Advisory.rtf
        5⤵
        
        PID:4180
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd
        6⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\10373190101\RenT7Wg.exe
      "C:\Users\Admin\AppData\Local\Temp\10373190101\RenT7Wg.exe"
      4⤵
      PID:6336
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:216
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:1684
  - - C:\Users\Admin\AppData\Local\Temp\10373200101\xQvtpl8.exe
      "C:\Users\Admin\AppData\Local\Temp\10373200101\xQvtpl8.exe"
      4⤵
      PID:4892
    - - C:\Windows\HelpPane.exe
        
        C:\Windows\HelpPane.exe
        5⤵
        
        PID:4776
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:2044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:6488
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:468
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:6964
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6792
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        7⤵
        
        PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\10373210101\G4gtDRI.exe
      "C:\Users\Admin\AppData\Local\Temp\10373210101\G4gtDRI.exe"
      4⤵
      PID:1640
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:6744
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:6804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:6560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
        6⤵
        
        PID:7012
  - - C:\Users\Admin\AppData\Local\Temp\10373220101\L6qQkwT.exe
      "C:\Users\Admin\AppData\Local\Temp\10373220101\L6qQkwT.exe"
      4⤵
      PID:4316
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1764
        5⤵
        Program crash
        
        PID:772
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 1772
        5⤵
        Program crash
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\10373230101\IfKyM0a.exe
      "C:\Users\Admin\AppData\Local\Temp\10373230101\IfKyM0a.exe"
      4⤵
      PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\10373240101\QL2M7cr.exe
      "C:\Users\Admin\AppData\Local\Temp\10373240101\QL2M7cr.exe"
      4⤵
      PID:2072
  - - C:\Users\Admin\AppData\Local\Temp\10373250101\r6JiyOq.exe
      "C:\Users\Admin\AppData\Local\Temp\10373250101\r6JiyOq.exe"
      4⤵
      PID:3424
  - - C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe
      "C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe"
      4⤵
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe
        
        "C:\Users\Admin\AppData\Local\Temp\10373260101\v9d9d.exe"
        5⤵
        
        PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\10373270101\AeeL4rc.exe
      "C:\Users\Admin\AppData\Local\Temp\10373270101\AeeL4rc.exe"
      4⤵
      PID:6680
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:3416
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:960
  - - C:\Users\Admin\AppData\Local\Temp\10373280101\OTIWCUm.exe
      "C:\Users\Admin\AppData\Local\Temp\10373280101\OTIWCUm.exe"
      4⤵
      PID:5444
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:3816
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:3856
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        
        PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\10373290101\bLGj4G0.exe
      "C:\Users\Admin\AppData\Local\Temp\10373290101\bLGj4G0.exe"
      4⤵
      PID:5960
  - - C:\Users\Admin\AppData\Local\Temp\10373300101\e8f668cf2d.exe
      "C:\Users\Admin\AppData\Local\Temp\10373300101\e8f668cf2d.exe"
      4⤵
      PID:4372
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Oq7wPMe.bat" "
        5⤵
        
        PID:1048
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c start "" "C:\Users\Admin\Desktop\on6jPp6S.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5820
- - C:\Users\Admin\Desktop\on6jPp6S.exe
    "C:\Users\Admin\Desktop\on6jPp6S.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Identifies Wine through registry keys
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4384
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        5⤵
        
        PID:1536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2012,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2008 /prefetch:2
        5⤵
        
        PID:688
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2248,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2256 /prefetch:3
        5⤵
        
        PID:2888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2368,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2528 /prefetch:8
        5⤵
        
        PID:5812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3156,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3188 /prefetch:1
        5⤵
        
        PID:2244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3268 /prefetch:1
        5⤵
        
        PID:2224
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4220,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4236 /prefetch:2
        5⤵
        
        PID:6036
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4540,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4580 /prefetch:1
        5⤵
        
        PID:5044
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5144,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5160 /prefetch:8
        5⤵
        
        PID:1520
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5152,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5464 /prefetch:8
        5⤵
        
        PID:5948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=4532,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5664 /prefetch:8
        5⤵
        
        PID:4712
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5600,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5820 /prefetch:8
        5⤵
        
        PID:2820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5844,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5972 /prefetch:8
        5⤵
        
        PID:5428
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5836,i,17296390222151603687,2549693164133641658,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5824 /prefetch:8
        5⤵
        
        PID:3468
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:4768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        5⤵
        
        PID:5960
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=552,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2456 /prefetch:3
        5⤵
        
        PID:2148
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2416,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2412 /prefetch:2
        5⤵
        
        PID:4668
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2120,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=2464 /prefetch:8
        5⤵
        
        PID:4540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3240 /prefetch:1
        5⤵
        
        PID:2340
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3160,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=3212 /prefetch:1
        5⤵
        
        PID:5596
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4008,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4024 /prefetch:2
        5⤵
        
        PID:5556
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4664,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=4640 /prefetch:1
        5⤵
        
        PID:2632
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5172,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5184 /prefetch:8
        5⤵
        
        PID:5904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5436,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5448 /prefetch:8
        5⤵
        
        PID:4720
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5884,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5896 /prefetch:8
        5⤵
        
        PID:4244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5564,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5796 /prefetch:8
        5⤵
        
        PID:6048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5904,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5308 /prefetch:8
        5⤵
        
        PID:3016
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5908,i,3407158501248869784,10296903450446426917,262144 --variations-seed-version=20250618-180047.684000 --mojo-platform-channel-handle=5972 /prefetch:8
        5⤵
        
        PID:3420
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:3076
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        5⤵
        
        PID:760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      PID:5348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff825addcf8,0x7ff825addd04,0x7ff825addd10
        5⤵
        
        PID:1644
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2108,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
        5⤵
        
        PID:3924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1904,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3
        5⤵
        
        PID:5364
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2340,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
        5⤵
        
        PID:2324
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3168,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:1
        5⤵
        
        PID:3628
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3200,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:5820
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4244,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
        5⤵
        
        PID:5244
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4632,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
        5⤵
        
        PID:2260
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5244,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
        5⤵
        
        PID:4128
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5432,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
        5⤵
        
        PID:5132
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5440,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
        5⤵
        
        PID:4544
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5348,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
        5⤵
        
        PID:2748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5344,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:8
        5⤵
        
        PID:264
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5280,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
        5⤵
        
        PID:2972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5960,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
        5⤵
        
        PID:6880
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5956,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:8
        5⤵
        
        PID:6888
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5912,i,701027410120564568,14885879246354116239,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
        5⤵
        
        PID:6896
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      PID:1068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x2dc,0x7ff80f0cf208,0x7ff80f0cf214,0x7ff80f0cf220
        5⤵
        
        PID:3784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1796,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
        5⤵
        
        PID:2936
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2280,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
        5⤵
        
        PID:4752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2540,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
        5⤵
        
        PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
        5⤵
        
        PID:5580
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3552,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
        5⤵
        
        PID:4776
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4968,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
        5⤵
        
        PID:4312
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4920,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
        5⤵
        
        PID:1340
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5388,i,12911041440487284736,5131749105963067144,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
        5⤵
        
        PID:1840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:4232
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:6424
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x360,0x7ff80f0cf208,0x7ff80f0cf214,0x7ff80f0cf220
        5⤵
        
        PID:6480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1736,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:3
        5⤵
        
        PID:6728
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2088,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
        5⤵
        
        PID:6748
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2404,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
        5⤵
        
        PID:6740
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3500,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
        5⤵
        
        PID:7080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3504,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:1
        5⤵
        
        PID:7048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4844,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
        5⤵
        
        PID:4576
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
        5⤵
        
        PID:3180
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6068,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
        5⤵
        
        PID:2028
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6672,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
        5⤵
        
        PID:1056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6620,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
        5⤵
        
        PID:4552
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6680,i,10187638289972675040,2192988007372011413,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
        5⤵
        
        PID:312
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:3820

C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe
C:\Users\Admin\AppData\Local\Temp\D5848832B09FD4445D2E2A00EA9F2500.exe
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "CXvDjB3J.exe" /setowner "SYSTEM"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\icacls.exe
    icacls "CXvDjB3J.exe" /setowner "SYSTEM"
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "CXvDjB3J.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4608
- - C:\Windows\SysWOW64\icacls.exe
    icacls "CXvDjB3J.exe" /inheritance:r /grant SYSTEM:F /grant Everyone:RX
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:3376
- C:\Windows\SysWOW64\cmd.exe
  "cmd.exe" /c icacls "CXvDjB3J.exe" /remove:d Everyone Administrators
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792
- - C:\Windows\SysWOW64\icacls.exe
    icacls "CXvDjB3J.exe" /remove:d Everyone Administrators
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4884
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:3792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3792 -s 536
    3⤵
    - Program crash
    PID:2936
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:3900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 508
    3⤵
    - Program crash
    PID:2504
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:5828
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5828 -s 508
    3⤵
    - Program crash
    PID:3688
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:5448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5448 -s 508
    3⤵
    - Program crash
    PID:4012
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:5488
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5488 -s 508
    3⤵
    - Program crash
    PID:6028
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:2232
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2232 -s 508
    3⤵
    - Program crash
    PID:212
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  - Executes dropped EXE
  PID:2748
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 508
    3⤵
    - Program crash
    PID:1632
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:1012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1012 -s 508
    3⤵
    - Program crash
    PID:5716
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 508
    3⤵
    - Program crash
    PID:5516
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:5452
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5452 -s 508
    3⤵
    - Program crash
    PID:5948
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6576
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6576 -s 508
    3⤵
    - Program crash
    PID:6644
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:7084
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7084 -s 508
    3⤵
    - Program crash
    PID:7128
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6280 -s 508
    3⤵
    - Program crash
    PID:6436
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:4128
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4128 -s 508
    3⤵
    - Program crash
    PID:1880
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6892
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6892 -s 508
    3⤵
    - Program crash
    PID:6948
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6300
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6300 -s 508
    3⤵
    - Program crash
    PID:432
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:3832
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3832 -s 508
    3⤵
    - Program crash
    PID:5400
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:808
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 808 -s 508
    3⤵
    - Program crash
    PID:4772
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:5820
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5820 -s 508
    3⤵
    - Program crash
    PID:5100
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:536
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 536 -s 508
    3⤵
    - Program crash
    PID:6832
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:3844
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3844 -s 508
    3⤵
    - Program crash
    PID:5572
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2840 -s 512
    3⤵
    - Program crash
    PID:6276
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:5188
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5188 -s 508
    3⤵
    - Program crash
    PID:5932
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6432
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6432 -s 508
    3⤵
    - Program crash
    PID:3184
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:1436
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1436 -s 508
    3⤵
    - Program crash
    PID:560
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6516
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6516 -s 508
    3⤵
    - Program crash
    PID:6768
- C:\Windows\SysWOW64\CXvDjB3J.exe
  "CXvDjB3J.exe"
  2⤵
  PID:6668
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 6668 -s 508
    3⤵
    - Program crash
    PID:3908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 3792 -ip 3792
1⤵
PID:4376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3900 -ip 3900
1⤵
PID:5204

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5828 -ip 5828
1⤵
PID:2088

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5448 -ip 5448
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5488 -ip 5488
1⤵
PID:2244

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2684 -ip 2684
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2232 -ip 2232
1⤵
PID:2768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 2684 -ip 2684
1⤵
PID:5904

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2748 -ip 2748
1⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5612

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1012 -ip 1012
1⤵
PID:2120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 3296 -ip 3296
1⤵
PID:5432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 5452 -ip 5452
1⤵
PID:1264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6576 -ip 6576
1⤵
PID:6596

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 7084 -ip 7084
1⤵
PID:7108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 6280 -ip 6280
1⤵
PID:6340

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:7076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 4128 -ip 4128
1⤵
PID:6340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 6892 -ip 6892
1⤵
PID:3104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6300 -ip 6300
1⤵
PID:6380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3832 -ip 3832
1⤵
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 808 -ip 808
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 5820 -ip 5820
1⤵
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4316 -ip 4316
1⤵
PID:7076

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 536 -ip 536
1⤵
PID:2820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4316 -ip 4316
1⤵
PID:1440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3844 -ip 3844
1⤵
PID:216

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 2840 -ip 2840
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 5188 -ip 5188
1⤵
PID:2228

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:5568

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6432 -ip 6432
1⤵
PID:4244

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5500

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1688

C:\Windows\system32\cmd.exe
cmd.exe /c start "" "C:\Users\Admin\Desktop\2jq4GUd2.sBm5q"
1⤵
PID:6100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1436 -ip 1436
1⤵
PID:2148

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 6516 -ip 6516
1⤵
PID:6036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6668 -ip 6668
1⤵
PID:6484

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:6564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

File and Directory Permissions Modification

T1222

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Virtualization/Sandbox Evasion