phantom_stealer | b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Control Panel\International\Geo\Nation	aKjaHHPf.exe

Executes dropped EXE 2 IoCs

pid	Process
6132	aKjaHHPf.exe
7080	aKjaHHPf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4400 set thread context of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 6132 set thread context of 7080	6132	aKjaHHPf.exe	174

Drops file in Program Files directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\cb3b6c17-19a8-47d3-bf78-25f8466c96d1.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6208_13406898086723547_6208.pma	setup.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Program Files\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\settings.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aKjaHHPf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aKjaHHPf.exe

Checks processor information in registry 2 TTPs 32 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134068980620455442"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	chrmstp.exe
Key created	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1919182765-2457925700-1517026611-1000\{28238848-48D1-4980-9A28-CB7E7935B636}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
212	schtasks.exe
6612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5792	powershell.exe
5280	powershell.exe
5792	powershell.exe
5280	powershell.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
836	chrome.exe
836	chrome.exe
836	chrome.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1924	powershell.exe
1924	powershell.exe
5372	powershell.exe
5372	powershell.exe
1924	powershell.exe
5372	powershell.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	powershell.exe
Token: SeDebugPrivilege	5280	powershell.exe
Token: SeDebugPrivilege	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeShutdownPrivilege	836	chrome.exe
Token: SeCreatePagefilePrivilege	836	chrome.exe
Token: SeDebugPrivilege	1924	powershell.exe
Token: SeDebugPrivilege	5372	powershell.exe
Token: SeDebugPrivilege	7080	aKjaHHPf.exe
Token: SeShutdownPrivilege	7856	chrome.exe
Token: SeCreatePagefilePrivilege	7856	chrome.exe
Token: SeShutdownPrivilege	7856	chrome.exe
Token: SeCreatePagefilePrivilege	7856	chrome.exe
Token: SeShutdownPrivilege	7856	chrome.exe
Token: SeCreatePagefilePrivilege	7856	chrome.exe
Token: SeShutdownPrivilege	7856	chrome.exe
Token: SeCreatePagefilePrivilege	7856	chrome.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
836	chrome.exe
836	chrome.exe
4480	chrmstp.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
5888	firefox.exe
3408	msedge.exe
3952	msedge.exe
5660	firefox.exe
5660	firefox.exe
5660	firefox.exe
5660	firefox.exe
5660	firefox.exe
5660	firefox.exe
5660	firefox.exe
5660	firefox.exe
7856	chrome.exe
7856	chrome.exe
8032	chrmstp.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5888	firefox.exe
5660	firefox.exe
1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4400 wrote to memory of 5792	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	87
PID 4400 wrote to memory of 5792	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	87
PID 4400 wrote to memory of 5792	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	87
PID 4400 wrote to memory of 5280	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4400 wrote to memory of 5280	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4400 wrote to memory of 5280	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	89
PID 4400 wrote to memory of 212	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	90
PID 4400 wrote to memory of 212	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	90
PID 4400 wrote to memory of 212	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	90
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 4400 wrote to memory of 1368	4400	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	93
PID 1368 wrote to memory of 836	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	97
PID 1368 wrote to memory of 836	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	97
PID 836 wrote to memory of 5444	836	chrome.exe	98
PID 836 wrote to memory of 5444	836	chrome.exe	98
PID 836 wrote to memory of 6036	836	chrome.exe	99
PID 836 wrote to memory of 6036	836	chrome.exe	99
PID 836 wrote to memory of 4140	836	chrome.exe	100
PID 836 wrote to memory of 4140	836	chrome.exe	100
PID 836 wrote to memory of 5760	836	chrome.exe	101
PID 836 wrote to memory of 5760	836	chrome.exe	101
PID 836 wrote to memory of 2592	836	chrome.exe	102
PID 836 wrote to memory of 2592	836	chrome.exe	102
PID 836 wrote to memory of 2172	836	chrome.exe	103
PID 836 wrote to memory of 2172	836	chrome.exe	103
PID 836 wrote to memory of 3596	836	chrome.exe	104
PID 836 wrote to memory of 3596	836	chrome.exe	104
PID 836 wrote to memory of 3220	836	chrome.exe	105
PID 836 wrote to memory of 3220	836	chrome.exe	105
PID 836 wrote to memory of 3492	836	chrome.exe	106
PID 836 wrote to memory of 3492	836	chrome.exe	106
PID 836 wrote to memory of 5424	836	chrome.exe	107
PID 836 wrote to memory of 5424	836	chrome.exe	107
PID 1368 wrote to memory of 5444	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	98
PID 1368 wrote to memory of 5444	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	98
PID 1368 wrote to memory of 6036	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	99
PID 1368 wrote to memory of 6036	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	99
PID 1368 wrote to memory of 836	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	97
PID 1368 wrote to memory of 836	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	97
PID 1368 wrote to memory of 5760	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	101
PID 1368 wrote to memory of 5760	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	101
PID 1368 wrote to memory of 4140	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	100
PID 1368 wrote to memory of 4140	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	100
PID 836 wrote to memory of 4200	836	chrome.exe	108
PID 836 wrote to memory of 4200	836	chrome.exe	108
PID 1368 wrote to memory of 3492	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	106
PID 1368 wrote to memory of 3492	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	106
PID 1368 wrote to memory of 5444	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	98
PID 1368 wrote to memory of 5444	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	98
PID 1368 wrote to memory of 5424	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	107
PID 1368 wrote to memory of 5424	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	107
PID 1368 wrote to memory of 2172	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	103
PID 1368 wrote to memory of 2172	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	103
PID 1368 wrote to memory of 6036	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	99
PID 1368 wrote to memory of 6036	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	99
PID 1368 wrote to memory of 4200	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	108
PID 1368 wrote to memory of 4200	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	108
PID 1368 wrote to memory of 836	1368	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1919182765-2457925700-1517026611-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe

C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
"C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5280
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aKjaHHPf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED3E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:212
- C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe
  "C:\Users\Admin\AppData\Local\Temp\b70a032e04e97acb028afd0c1705d024a0e295bb5239bb1878a126b09d21334c.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:1368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba681dcf8,0x7ffba681dd04,0x7ffba681dd10
      4⤵
      PID:5444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1928,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
      4⤵
      PID:6036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --field-trial-handle=1980,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
      4⤵
      PID:4140
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --field-trial-handle=1656,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:8
      4⤵
      PID:5760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2844,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:1
      4⤵
      PID:2592
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2860,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:1
      4⤵
      PID:2172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3320,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:3596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3336,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:2
      4⤵
      PID:3220
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3376,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:3492
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3404,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:2
      4⤵
      PID:5424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=2824,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      PID:4200
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --field-trial-handle=4852,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:8
      4⤵
      PID:4244
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4956,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:1
      4⤵
      PID:4880
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4980,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:5740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5040,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
      4⤵
      PID:1732
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:6068
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff796f41f58,0x7ff796f41f64,0x7ff796f41f70
        5⤵
        Drops file in Program Files directory
        
        PID:3036
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:4480
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff796f41f58,0x7ff796f41f64,0x7ff796f41f70
        6⤵
        Drops file in Program Files directory
        
        PID:5816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5104,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:1
      4⤵
      PID:1216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5072,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
      4⤵
      PID:2308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5028,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
      4⤵
      PID:808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\l2fqya1h.qro" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5088,i,18168249019932591076,3964849284867237852,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
      4⤵
      PID:1844
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\0dm0pvb2.gal"
    3⤵
    PID:3804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\0dm0pvb2.gal
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5888
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27021 -prefMapHandle 1996 -prefMapSize 270249 -ipcHandle 2076 -initialChannelId {023af657-23b6-455a-abaf-894d8f5cd51a} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:1552
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2140 -prefsLen 27057 -prefMapHandle 2072 -prefMapSize 270249 -ipcHandle 2356 -initialChannelId {9cea2b09-9bcb-4f19-87b1-f780a01084d5} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2308
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\797bc418-16ec-4e3b-9de9-99b8d1c03bf6.dmp"
        5⤵
        
        PID:5788
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2920 -prefsLen 27057 -prefMapHandle 2924 -prefMapSize 270249 -ipcHandle 2140 -initialChannelId {9acab86a-0341-4fe2-afac-fc41fecefa84} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:4144
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e12b21a9-eb53-44f2-9a6d-ab3c3c78880a.dmp"
        5⤵
        
        PID:4156
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2908 -prefsLen 27057 -prefMapHandle 3040 -prefMapSize 270249 -ipcHandle 3076 -initialChannelId {dce64569-ee9e-46d4-b6f6-01fdf111dba3} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5320
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\9269a87a-c147-4c33-a068-2efd3b06782a.dmp"
        5⤵
        
        PID:744
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3780 -prefsLen 27122 -prefMapHandle 3784 -prefMapSize 270249 -ipcHandle 3792 -initialChannelId {963c71ba-761d-4326-8020-9c23848d7c75} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:4608
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3780 -prefsLen 27247 -prefMapHandle 3520 -prefMapSize 270249 -jsInitHandle 3512 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3860 -initialChannelId {1cef804c-eb28-4c91-a601-b6b2c406e160} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        Checks processor information in registry
        
        PID:2888
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e1f98558-6cfe-45e3-82be-483b10fac486.dmp"
        5⤵
        
        PID:2844
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4036 -prefsLen 27247 -prefMapHandle 3792 -prefMapSize 270249 -ipcHandle 3076 -initialChannelId {15657a25-5ea6-4280-8970-168d1e6fbf76} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:448
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\dd2f03d7-940d-4c64-8307-1347a3573807.dmp"
        5⤵
        
        PID:5704
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4400 -prefsLen 27247 -prefMapHandle 4404 -prefMapSize 270249 -ipcHandle 4412 -initialChannelId {b5a83794-0c70-408d-a4fb-f686d2a3e625} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 rdd
        5⤵
        
        PID:3684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3360 -prefsLen 34746 -prefMapHandle 3456 -prefMapSize 270249 -jsInitHandle 3016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3508 -initialChannelId {c2f910f3-99a7-4218-9e7b-2b53b0ab1c16} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
        5⤵
        Checks processor information in registry
        
        PID:5324
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4200 -prefsLen 34746 -prefMapHandle 940 -prefMapSize 270249 -ipcHandle 2960 -initialChannelId {784c5fff-39e6-4dbf-bba6-f9e98eef930b} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 utility
        5⤵
        Checks processor information in registry
        
        PID:6468
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2612 -prefsLen 32650 -prefMapHandle 5160 -prefMapSize 270249 -jsInitHandle 5164 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5172 -initialChannelId {8660435d-a959-4837-ad68-c602ed8950ce} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
        5⤵
        Checks processor information in registry
        
        PID:6476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5212 -prefsLen 32650 -prefMapHandle 5216 -prefMapSize 270249 -jsInitHandle 5220 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5164 -initialChannelId {6332081c-8c18-41b7-abad-7803f2730a6d} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 tab
        5⤵
        Checks processor information in registry
        
        PID:6488
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5604 -prefsLen 32650 -prefMapHandle 5608 -prefMapSize 270249 -jsInitHandle 5612 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5620 -initialChannelId {3cbac93b-d886-4977-b9ea-8c67e0d10f0d} -parentPid 5888 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5888" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
        5⤵
        Checks processor information in registry
        
        PID:6636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb96f3f208,0x7ffb96f3f214,0x7ffb96f3f220
      4⤵
      PID:1104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2168,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
      4⤵
      PID:4920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=1868,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
      4⤵
      PID:1456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=2196,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:8
      4⤵
      PID:3336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3288,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:1
      4⤵
      PID:5828
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3364,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=3772,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:8
      4⤵
      PID:6456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=3776,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:8
      4⤵
      PID:6496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=3784,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8
      4⤵
      PID:6504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3880,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      PID:6524
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3916,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:2
      4⤵
      PID:6520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3936,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
      4⤵
      PID:6508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=4008,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4064 /prefetch:2
      4⤵
      PID:6540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=4044,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:1
      4⤵
      PID:4952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4104,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:2
      4⤵
      PID:6560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4116,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
      4⤵
      PID:6548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4184,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
      4⤵
      PID:6580
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4216,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:1
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4232,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:2
      4⤵
      PID:6648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=5368,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
      4⤵
      PID:2640
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --always-read-main-dll --field-trial-handle=5376,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
      4⤵
      PID:6700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --field-trial-handle=3964,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:1
      4⤵
      PID:3368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\xznwb30m.53h" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --field-trial-handle=4780,i,12580564118543063767,6659301130612888350,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:3184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:3952
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x218,0x248,0x7ffb96f3f208,0x7ffb96f3f214,0x7ffb96f3f220
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2152,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:5448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=1668,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3
      4⤵
      PID:2104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=1872,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:8
      4⤵
      PID:6100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3332,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:1
      4⤵
      PID:3520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --instant-process --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3344,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
      4⤵
      PID:5128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=3768,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
      4⤵
      PID:6092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=3776,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=3900 /prefetch:8
      4⤵
      PID:6808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=3784,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
      4⤵
      PID:4888
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=3736,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4004 /prefetch:1
      4⤵
      PID:3096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=3892,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:2
      4⤵
      PID:6444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=3940,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:1
      4⤵
      PID:6912
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=3964,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:2
      4⤵
      PID:3256
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=3996,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
      4⤵
      PID:4932
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=4064,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
      4⤵
      PID:5224
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=4104,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
      4⤵
      PID:5472
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=4132,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
      4⤵
      PID:4484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=4176,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
      4⤵
      PID:2324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --extension-process --renderer-sub-type=extension --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4156,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
      4⤵
      PID:5028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=5384,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:8
      4⤵
      PID:7236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=3376,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:8
      4⤵
      PID:7244
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=5844,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\4ko2y54l.rea" --always-read-main-dll --field-trial-handle=5844,i,13003288743241172443,457429120350929091,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
      4⤵
      PID:6732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:2648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff61a9d6a68,0x7ff61a9d6a74,0x7ff61a9d6a80
        5⤵
        Drops file in Program Files directory
        
        PID:1568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        
        PID:6208
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ff61a9d6a68,0x7ff61a9d6a74,0x7ff61a9d6a80
        6⤵
        Drops file in Program Files directory
        
        PID:8004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qo5evact.1c4"
    3⤵
    PID:5992
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qo5evact.1c4
      4⤵
      Checks processor information in registry
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5660
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27021 -prefMapHandle 1980 -prefMapSize 270301 -ipcHandle 2072 -initialChannelId {d3eae496-99d2-4a3b-aaaf-21834d752fb2} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:544
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2228 -prefsLen 27057 -prefMapHandle 2216 -prefMapSize 270301 -ipcHandle 2432 -initialChannelId {ad95dcd6-6c99-4db4-bae3-6d13a5a3b3bc} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:2656
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f184c9bf-650f-466b-ad71-3813c8715aee.dmp"
        5⤵
        
        PID:2900
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1976 -prefsLen 27057 -prefMapHandle 2812 -prefMapSize 270301 -ipcHandle 2820 -initialChannelId {09b39363-021f-4081-9989-56a708e78913} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6244
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a708dac8-8989-4e32-8170-d100dec6d072.dmp"
        5⤵
        
        PID:7476
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1888 -prefsLen 27057 -prefMapHandle 3076 -prefMapSize 270301 -ipcHandle 3020 -initialChannelId {06519127-9fa0-418d-9caf-d8269cfa9ffc} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:3496
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\54457595-fee5-4fdf-a1cf-ea4339eacc5f.dmp"
        5⤵
        
        PID:7276
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1888 -prefsLen 27122 -prefMapHandle 2900 -prefMapSize 270301 -ipcHandle 3472 -initialChannelId {dd4d3f00-1d29-40a1-a2d4-a21a738fff84} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:7288
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3100 -prefsLen 27198 -prefMapHandle 2824 -prefMapSize 270301 -jsInitHandle 2880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3816 -initialChannelId {833fd482-d987-4d68-8ddf-65f03d8a22d0} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 tab
        5⤵
        
        PID:7624
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\0e1188a8-59ce-43c0-bff2-521f915e04a0.dmp"
        5⤵
        
        PID:5096
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4012 -prefsLen 27198 -prefMapHandle 4020 -prefMapSize 270301 -ipcHandle 3484 -initialChannelId {9961fb41-740e-4e9d-8cf6-cd4e9938ec86} -parentPid 5660 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5660" -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 gpu
        5⤵
        
        PID:6088
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo"
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:7856
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\022bierf.tzo /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\022bierf.tzo\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\022bierf.tzo --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffba681dcf8,0x7ffba681dd04,0x7ffba681dd10
      4⤵
      PID:7012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAAAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=2316,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
      4⤵
      PID:6396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --field-trial-handle=1760,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
      4⤵
      PID:6408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --field-trial-handle=1976,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:8
      4⤵
      PID:6544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2904,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
      4⤵
      PID:4584
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2932,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:1
      4⤵
      PID:6596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3272,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:1
      4⤵
      PID:8004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3256,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:2
      4⤵
      PID:3076
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3348,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:1
      4⤵
      PID:6288
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --extension-process --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3356,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:2
      4⤵
      PID:7136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4132,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:1
      4⤵
      PID:6196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --field-trial-handle=4880,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
      4⤵
      PID:3680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4972,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:7232
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5008,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:7832
  - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Program Files directory
      PID:2336
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x26c,0x270,0x274,0x248,0x278,0x7ff796f41f58,0x7ff796f41f64,0x7ff796f41f70
        5⤵
        Drops file in Program Files directory
        
        PID:6988
    - - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Program Files directory
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:8032
      - C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\133.0.6943.60\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff796f41f58,0x7ff796f41f64,0x7ff796f41f70
        6⤵
        Drops file in Program Files directory
        
        PID:8028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5024,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
      4⤵
      PID:7056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --user-data-dir="C:\Users\Admin\AppData\Local\Temp\022bierf.tzo" --enable-dinosaur-easter-egg-alt-images --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5260,i,17977101025357760025,17518185711474717609,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
      4⤵
      PID:5280

C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:6132
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1924
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5372
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aKjaHHPf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3E8B.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:6612
- C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe
  "C:\Users\Admin\AppData\Roaming\aKjaHHPf.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:7080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery