8c9c2166540a91ea552fc112b770b15e492be62ca7f3d4919ec0b946da5a794b

pid	Process
2432	chrome.exe
5072	chrome.exe
3752	chrome.exe
5540	chrome.exe
1180	chrome.exe
4652	chrome.exe
3664	chrome.exe
3344	chrome.exe
5532	chrome.exe
6004	chrome.exe
5276	chrome.exe
5912	chrome.exe
2128	chrome.exe
5872	chrome.exe
5968	chrome.exe
5216	chrome.exe
1176	chrome.exe
3628	chrome.exe
5284	chrome.exe
5936	chrome.exe
1264	chrome.exe
5748	chrome.exe
5660	chrome.exe

Executes dropped EXE 3 IoCs

pid	Process
1076	steamcmd.exe
1864	steamcmd.exe
4512	steamcmd.exe

Loads dropped DLL 40 IoCs

pid	Process
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
1864	steamcmd.exe
4512	steamcmd.exe
4512	steamcmd.exe
4512	steamcmd.exe
4512	steamcmd.exe
4512	steamcmd.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe
4124	Streamline.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Streamline.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\Captures\desktop.ini	svchost.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1526504112\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1526504112\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4388_1526504112\manifest.fingerprint	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steamcmd.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	steamcmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamcmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamcmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4768	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamcmd.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamcmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamcmd.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamcmd.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

defense_evasion spyware trojan

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209926066700791"	msedgewebview2.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{E49214D2-309C-4E0B-A6F0-ADE278E589D8}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	Streamline.exe

Modifies system certificate store 2 TTPs 1 IoCs

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	steamcmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4512	steamcmd.exe
4512	steamcmd.exe
1176	chrome.exe
1176	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
4388	msedgewebview2.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe
1176	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	Streamline.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe
Token: SeCreatePagefilePrivilege	1176	chrome.exe
Token: SeShutdownPrivilege	1176	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1176	chrome.exe
1176	chrome.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2968	MiniSearchHost.exe
5284	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 4124	2848	Streamline.exe	79
PID 4124 wrote to memory of 2392	4124	Streamline.exe	82
PID 2392 wrote to memory of 1076	2392	cmd.exe	84
PID 4124 wrote to memory of 4388	4124	Streamline.exe	85
PID 4388 wrote to memory of 1976	4388	msedgewebview2.exe	86
PID 4388 wrote to memory of 1576	4388	msedgewebview2.exe	88
PID 4388 wrote to memory of 1576	4388	msedgewebview2.exe	88
PID 4388 wrote to memory of 1576	4388	msedgewebview2.exe	88
PID 4388 wrote to memory of 4576	4388	msedgewebview2.exe	89
PID 4388 wrote to memory of 1156	4388	msedgewebview2.exe	90
PID 4388 wrote to memory of 1156	4388	msedgewebview2.exe	90
PID 4388 wrote to memory of 4772	4388	msedgewebview2.exe	91
PID 4388 wrote to memory of 4772	4388	msedgewebview2.exe	91
PID 4388 wrote to memory of 4772	4388	msedgewebview2.exe	91
PID 1076 wrote to memory of 1864	1076	steamcmd.exe	92
PID 1864 wrote to memory of 4512	1864	steamcmd.exe	93
PID 4124 wrote to memory of 1176	4124	Streamline.exe	94
PID 1176 wrote to memory of 476	1176	chrome.exe	95
PID 1176 wrote to memory of 1908	1176	chrome.exe	96
PID 1176 wrote to memory of 4768	1176	chrome.exe	97
PID 1176 wrote to memory of 1908	1176	chrome.exe	96
PID 1176 wrote to memory of 4932	1176	chrome.exe	98
PID 1176 wrote to memory of 4932	1176	chrome.exe	98
PID 1176 wrote to memory of 2432	1176	chrome.exe	99
PID 1176 wrote to memory of 2432	1176	chrome.exe	99
PID 1176 wrote to memory of 3628	1176	chrome.exe	100
PID 1176 wrote to memory of 3628	1176	chrome.exe	100
PID 1176 wrote to memory of 1180	1176	chrome.exe	101
PID 1176 wrote to memory of 1180	1176	chrome.exe	101
PID 1176 wrote to memory of 4652	1176	chrome.exe	102
PID 1176 wrote to memory of 4652	1176	chrome.exe	102
PID 1176 wrote to memory of 3664	1176	chrome.exe	103
PID 1176 wrote to memory of 3664	1176	chrome.exe	103
PID 1176 wrote to memory of 3344	1176	chrome.exe	104
PID 1176 wrote to memory of 3344	1176	chrome.exe	104
PID 1176 wrote to memory of 5072	1176	chrome.exe	105
PID 1176 wrote to memory of 5072	1176	chrome.exe	105
PID 1176 wrote to memory of 4416	1176	chrome.exe	106
PID 1176 wrote to memory of 4416	1176	chrome.exe	106
PID 1176 wrote to memory of 3752	1176	chrome.exe	107
PID 1176 wrote to memory of 3752	1176	chrome.exe	107
PID 1176 wrote to memory of 5276	1176	chrome.exe	108
PID 1176 wrote to memory of 5276	1176	chrome.exe	108
PID 1176 wrote to memory of 5284	1176	chrome.exe	109
PID 1176 wrote to memory of 5284	1176	chrome.exe	109
PID 1176 wrote to memory of 5524	1176	chrome.exe	110
PID 1176 wrote to memory of 5540	1176	chrome.exe	112
PID 1176 wrote to memory of 5540	1176	chrome.exe	112
PID 1176 wrote to memory of 5532	1176	chrome.exe	111
PID 1176 wrote to memory of 5532	1176	chrome.exe	111
PID 1176 wrote to memory of 5912	1176	chrome.exe	113
PID 1176 wrote to memory of 5928	1176	chrome.exe	115
PID 1176 wrote to memory of 5912	1176	chrome.exe	113
PID 1176 wrote to memory of 5936	1176	chrome.exe	116
PID 1176 wrote to memory of 5928	1176	chrome.exe	115
PID 1176 wrote to memory of 5936	1176	chrome.exe	116
PID 1176 wrote to memory of 5920	1176	chrome.exe	114
PID 1176 wrote to memory of 5920	1176	chrome.exe	114
PID 1176 wrote to memory of 2128	1176	chrome.exe	118
PID 1176 wrote to memory of 1264	1176	chrome.exe	120
PID 1176 wrote to memory of 2128	1176	chrome.exe	118
PID 1176 wrote to memory of 4224	1176	chrome.exe	121
PID 1176 wrote to memory of 1264	1176	chrome.exe	120
PID 1176 wrote to memory of 4224	1176	chrome.exe	121

C:\Users\Admin\AppData\Local\Temp\Streamline.exe
"C:\Users\Admin\AppData\Local\Temp\Streamline.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\Streamline.exe
  C:\Users\Admin\AppData\Local\Temp\Streamline.exe
  2⤵
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4124
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe +quit"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe
      C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe +quit
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1076
    - - C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe" "+quit"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies trusted root certificate store through registry
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe
        
        C:\Users\Admin\AppData\Local\Temp\Files\steamcmd\steamcmd.exe +quit
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        
        PID:4512
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=Streamline.exe --webview-exe-version=2.0.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=1 --allow-file-access-from-files --disable-features=ElasticOverscroll --mojo-named-platform-channel-pipe=4124.5040.1100899658898036117
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of WriteProcessMemory
    PID:4388
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffea1e2b078,0x7ffea1e2b084,0x7ffea1e2b090
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView" --webview-exe-name=Streamline.exe --webview-exe-version=2.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1684,i,2623675371125803073,16160849198675146604,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
      4⤵
      PID:1576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView" --webview-exe-name=Streamline.exe --webview-exe-version=2.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2000,i,2623675371125803073,16160849198675146604,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:11
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView" --webview-exe-name=Streamline.exe --webview-exe-version=2.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=2356,i,2623675371125803073,16160849198675146604,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
      4⤵
      PID:1156
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView" --webview-exe-name=Streamline.exe --webview-exe-version=2.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --disable-databases --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3632,i,2623675371125803073,16160849198675146604,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
      4⤵
      PID:4772
  - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\tmpwf9m4eqg\EBWebView" --webview-exe-name=Streamline.exe --webview-exe-version=2.0.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=1 --always-read-main-dll --field-trial-handle=4460,i,2623675371125803073,16160849198675146604,262144 --disable-features=ElasticOverscroll --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
      4⤵
      PID:2096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --remote-allow-origins=* --no-first-run --no-service-autorun --no-default-browser-check --homepage=about:blank --no-pings --password-store=basic --disable-infobars --disable-breakpad --disable-dev-shm-usage --disable-session-crashed-bubble --disable-features=IsolateOrigins,site-per-process --disable-search-engine-choice-screen --headless=new --remote-debugging-host=127.0.0.1 --remote-debugging-port=52728 --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp
    3⤵
    - Uses browser remote debugging
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe9b0dc728,0x7ffe9b0dc734,0x7ffe9b0dc740
      4⤵
      PID:476
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-breakpad --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
      4⤵
      PID:1908
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
      4⤵
      System Time Discovery
      PID:4768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
      4⤵
      PID:4932
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:1180
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:4652
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:3344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=4948 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
      4⤵
      PID:4416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:3752
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5276
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5284
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:14
      4⤵
      PID:5524
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5532
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5540
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5912
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
      4⤵
      PID:5920
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
      4⤵
      PID:5928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:2128
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
      4⤵
      PID:4020
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:1264
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:14
      4⤵
      PID:4224
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
      4⤵
      PID:5868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
      4⤵
      PID:5884
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:5968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:9
      4⤵
      Uses browser remote debugging
      PID:6004
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-breakpad --remote-debugging-port=52728 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:1
      4⤵
      Uses browser remote debugging
      PID:5216
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
      4⤵
      PID:5152
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
      4⤵
      PID:5872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Temp\bota\52728_1iia9wvp" --force-high-res-timeticks=disabled --field-trial-handle=1856,i,2740234651413877492,4872767184264081242,262144 --disable-features=IsolateOrigins,PaintHolding,site-per-process --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:14
      4⤵
      PID:3428

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5904

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
PID:6056

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Modify Authentication Process

Privilege Escalation

Defense Evasion

Modify Authentication Process

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Modify Authentication Process

Steal Web Session Cookie

T1539

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery