destiny_stealer | e0be0a8c8c741e821bea2b66c2aea511e33da9aaf9199a30f6df4dd1ba36f980

credential_access stealer

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	aegslz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Security = "\"C:\\ProgramData\\Microsoft\\Runtime Broker.exe\""	aegslz.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	Runtime Broker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Windows Security = "\"C:\\ProgramData\\Microsoft\\Runtime Broker.exe\""	Runtime Broker.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1320	powershell.exe
1564	powershell.exe
6440	powershell.exe

Uses browser remote debugging 2 TTPs 24 IoCs

Can be used control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
896	chrome.exe
2460	msedge.exe
5204	msedge.exe
4588	msedge.exe
3292	chrome.exe
3280	msedge.exe
4968	msedge.exe
5292	msedge.exe
4912	msedge.exe
2752	chrome.exe
3760	chrome.exe
1720	chrome.exe
3588	chrome.exe
4600	chrome.exe
1856	msedge.exe
1500	msedge.exe
5976	msedge.exe
3324	chrome.exe
5088	chrome.exe
3620	chrome.exe
3524	msedge.exe
4152	msedge.exe
3704	msedge.exe
4376	msedge.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xeno.lnk	Runtime Broker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Xeno.lnk	Runtime Broker.exe

Executes dropped EXE 13 IoCs

pid	Process
1868	RC7_UI.exe
2828	Runtime Broker.exe
2060	Xeno.exe
4528	Xeno.exe
2068	Sdlibrfpb.exe
2608	aegslz.exe
3632	Runtime Broker.exe
2536	Xeno.exe
4960	Runtime Broker.exe
1840	YvA0fSUPIxVjsA2c.exe
3548	Xeno.exe
5488	main.exe
3508	Xeno.exe

Loads dropped DLL 19 IoCs

pid	Process
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security = "\"C:\\ProgramData\\Microsoft\\Runtime Broker.exe\""	aegslz.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Security = "\"C:\\ProgramData\\Microsoft\\Runtime Broker.exe\""	aegslz.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Security = "\"C:\\ProgramData\\Microsoft\\Runtime Broker.exe\""	Runtime Broker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Security = "\"C:\\ProgramData\\Microsoft\\Runtime Broker.exe\""	Runtime Broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Runtime Broker = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Runtime Broker.exe"	RC7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xeno = "C:\\ProgramData\\Xeno.exe"	Runtime Broker.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3116	certutil.exe
2592	certutil.exe

Suspicious use of SetThreadContext 14 IoCs

description	pid	Process	procid_target
PID 3632 set thread context of 1708	3632	Runtime Broker.exe	103
PID 1840 set thread context of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 set thread context of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 set thread context of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 set thread context of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 set thread context of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 set thread context of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 set thread context of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 set thread context of 2452	1840	YvA0fSUPIxVjsA2c.exe	120
PID 1840 set thread context of 4892	1840	YvA0fSUPIxVjsA2c.exe	122
PID 1840 set thread context of 1804	1840	YvA0fSUPIxVjsA2c.exe	123
PID 1840 set thread context of 3084	1840	YvA0fSUPIxVjsA2c.exe	124
PID 1840 set thread context of 2092	1840	YvA0fSUPIxVjsA2c.exe	125
PID 1840 set thread context of 3384	1840	YvA0fSUPIxVjsA2c.exe	127

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2916	1868	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Sdlibrfpb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Runtime Broker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YvA0fSUPIxVjsA2c.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RC7_UI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aegslz.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WScript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1180	chrome.exe
1004	chrome.exe
4880	msedge.exe
72	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	YvA0fSUPIxVjsA2c.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	YvA0fSUPIxVjsA2c.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
3564	taskkill.exe
5548	taskkill.exe
1992	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134222997098237954"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	Runtime Broker.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\Local Settings	aegslz.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-2122505878-652277452-2375749442-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2122505878-652277452-2375749442-1000\{D4F77467-EF42-44CB-BB8D-646D256713F7}	msedge.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 52 IoCs

pid	Process
1320	powershell.exe
1320	powershell.exe
3632	Runtime Broker.exe
3632	Runtime Broker.exe
3264	grpconv.exe
3264	grpconv.exe
1840	YvA0fSUPIxVjsA2c.exe
1840	YvA0fSUPIxVjsA2c.exe
4736	grpconv.exe
4736	grpconv.exe
4736	grpconv.exe
4736	grpconv.exe
4736	grpconv.exe
4736	grpconv.exe
4736	grpconv.exe
4736	grpconv.exe
2452	grpconv.exe
2452	grpconv.exe
1840	YvA0fSUPIxVjsA2c.exe
1840	YvA0fSUPIxVjsA2c.exe
1840	YvA0fSUPIxVjsA2c.exe
1840	YvA0fSUPIxVjsA2c.exe
3384	grpconv.exe
3384	grpconv.exe
3384	grpconv.exe
3384	grpconv.exe
1840	YvA0fSUPIxVjsA2c.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
3324	chrome.exe
3324	chrome.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
5088	chrome.exe
5088	chrome.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
1564	powershell.exe
6440	powershell.exe
6440	powershell.exe
5488	main.exe
5488	main.exe
5488	main.exe
5488	main.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3632	Runtime Broker.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1320	powershell.exe
Token: SeDebugPrivilege	2828	Runtime Broker.exe
Token: SeDebugPrivilege	2828	Runtime Broker.exe
Token: SeDebugPrivilege	2060	Xeno.exe
Token: SeDebugPrivilege	4528	Xeno.exe
Token: SeDebugPrivilege	2536	Xeno.exe
Token: SeDebugPrivilege	1840	YvA0fSUPIxVjsA2c.exe
Token: SeDebugPrivilege	2452	grpconv.exe
Token: SeDebugPrivilege	1564	powershell.exe
Token: SeDebugPrivilege	3548	Xeno.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	3324	chrome.exe
Token: SeCreatePagefilePrivilege	3324	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeShutdownPrivilege	5088	chrome.exe
Token: SeCreatePagefilePrivilege	5088	chrome.exe
Token: SeDebugPrivilege	6440	powershell.exe
Token: SeDebugPrivilege	1992	taskkill.exe
Token: SeDebugPrivilege	3564	taskkill.exe
Token: SeDebugPrivilege	5548	taskkill.exe
Token: SeDebugPrivilege	5488	main.exe
Token: SeDebugPrivilege	5488	main.exe
Token: SeDebugPrivilege	3508	Xeno.exe

Suspicious use of FindShellTrayWindow 6 IoCs

pid	Process
3324	chrome.exe
5088	chrome.exe
3280	msedge.exe
3280	msedge.exe
5976	msedge.exe
5976	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3632	Runtime Broker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1868	3240	RC7.exe	80
PID 3240 wrote to memory of 1320	3240	RC7.exe	81
PID 3240 wrote to memory of 2828	3240	RC7.exe	86
PID 2828 wrote to memory of 4132	2828	Runtime Broker.exe	87
PID 2828 wrote to memory of 3248	2828	Runtime Broker.exe	94
PID 3248 wrote to memory of 3116	3248	WScript.exe	95
PID 3248 wrote to memory of 2068	3248	WScript.exe	97
PID 2828 wrote to memory of 2608	2828	Runtime Broker.exe	98
PID 2608 wrote to memory of 1652	2608	aegslz.exe	99
PID 3632 wrote to memory of 2824	3632	Runtime Broker.exe	102
PID 3632 wrote to memory of 1708	3632	Runtime Broker.exe	103
PID 1652 wrote to memory of 812	1652	WScript.exe	105
PID 812 wrote to memory of 4960	812	cmd.exe	107
PID 2828 wrote to memory of 3600	2828	Runtime Broker.exe	108
PID 3600 wrote to memory of 2592	3600	WScript.exe	109
PID 3600 wrote to memory of 1840	3600	WScript.exe	111
PID 1840 wrote to memory of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 wrote to memory of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 wrote to memory of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 wrote to memory of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 wrote to memory of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 wrote to memory of 3264	1840	YvA0fSUPIxVjsA2c.exe	112
PID 1840 wrote to memory of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 wrote to memory of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 wrote to memory of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 wrote to memory of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 wrote to memory of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 wrote to memory of 1320	1840	YvA0fSUPIxVjsA2c.exe	113
PID 1840 wrote to memory of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 wrote to memory of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 wrote to memory of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 wrote to memory of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 wrote to memory of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 wrote to memory of 1384	1840	YvA0fSUPIxVjsA2c.exe	114
PID 1840 wrote to memory of 4188	1840	YvA0fSUPIxVjsA2c.exe	115
PID 1840 wrote to memory of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 wrote to memory of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 wrote to memory of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 wrote to memory of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 wrote to memory of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 wrote to memory of 2364	1840	YvA0fSUPIxVjsA2c.exe	116
PID 1840 wrote to memory of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 wrote to memory of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 wrote to memory of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 wrote to memory of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 wrote to memory of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 wrote to memory of 920	1840	YvA0fSUPIxVjsA2c.exe	117
PID 1840 wrote to memory of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 wrote to memory of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 wrote to memory of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 wrote to memory of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 wrote to memory of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 wrote to memory of 4736	1840	YvA0fSUPIxVjsA2c.exe	118
PID 1840 wrote to memory of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 wrote to memory of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 wrote to memory of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 wrote to memory of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 wrote to memory of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 wrote to memory of 1312	1840	YvA0fSUPIxVjsA2c.exe	119
PID 1840 wrote to memory of 2452	1840	YvA0fSUPIxVjsA2c.exe	120
PID 1840 wrote to memory of 2452	1840	YvA0fSUPIxVjsA2c.exe	120
PID 1840 wrote to memory of 2452	1840	YvA0fSUPIxVjsA2c.exe	120
PID 1840 wrote to memory of 2452	1840	YvA0fSUPIxVjsA2c.exe	120
PID 1840 wrote to memory of 2452	1840	YvA0fSUPIxVjsA2c.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\RC7.exe
"C:\Users\Admin\AppData\Local\Temp\RC7.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe
  "C:\Users\Admin\AppData\Local\Temp\RC7_UI.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1868
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1868 -s 1068
    3⤵
    - Program crash
    PID:2916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe
  "C:\Users\Admin\AppData\Local\Temp\Runtime Broker.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2828
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "Xeno" /tr "C:\ProgramData\Xeno.exe"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\actvvh.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -decode "C:\Users\Admin\AppData\Roaming\Sdlibrfpb.b64" "C:\Users\Admin\AppData\Roaming\Sdlibrfpb.exe"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:3116
  - - C:\Users\Admin\AppData\Roaming\Sdlibrfpb.exe
      "C:\Users\Admin\AppData\Roaming\Sdlibrfpb.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2068
- - C:\Users\Admin\AppData\Local\Temp\aegslz.exe
    "C:\Users\Admin\AppData\Local\Temp\aegslz.exe"
    3⤵
    - Adds policy Run key to start application
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2608
  - - C:\Windows\SysWOW64\WScript.exe
      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\install.vbs"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1652
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\Microsoft\Runtime Broker.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:812
      - C:\ProgramData\Microsoft\Runtime Broker.exe
        
        "C:\ProgramData\Microsoft\Runtime Broker.exe"
        6⤵
        Executes dropped EXE
        
        PID:4960
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\wpvcpm.vbs"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\System32\certutil.exe
      "C:\Windows\System32\certutil.exe" -decode "C:\Users\Admin\AppData\Roaming\YvA0fSUPIxVjsA2c.b64" "C:\Users\Admin\AppData\Roaming\YvA0fSUPIxVjsA2c.exe"
      4⤵
      Deobfuscate/Decode Files or Information
      PID:2592
  - - C:\Users\Admin\AppData\Roaming\YvA0fSUPIxVjsA2c.exe
      "C:\Users\Admin\AppData\Roaming\YvA0fSUPIxVjsA2c.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1840
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AlternativeEdgeCookies-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3264
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\FirefoxCookies-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1320
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\InstalledApps-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1384
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260503173427.html"
        5⤵
        
        PID:4188
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /shtml "C:\Users\Admin\AppData\Roaming\watch-output_20260503173427.html"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2364
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ChromeV20-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:920
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\BrowserHistory-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4736
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\DefenderLogs-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1312
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\WorkingTasks-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2452
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260503173427.txt"
        5⤵
        
        PID:5108
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Bookmarks-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4892
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ProductKeys-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1804
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\ExtensionsView-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3084
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\Autofill-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260503173427.txt"
        5⤵
        
        PID:1732
    - - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\SysWOW64\grpconv.exe" /stext "C:\Users\Admin\AppData\Roaming\AllPasswords-output_20260503173427.txt"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:3384
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell.exe" -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\CookieExtractor_53e7dc97\cookieextract.ps1" -Browser Both -OutputDir "C:\Users\Admin\AppData\Roaming"
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1564
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:3324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x88,0x110,0x7ffa71e3c728,0x7ffa71e3c734,0x7ffa71e3c740
        7⤵
        
        PID:3288
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1832 /prefetch:2
        7⤵
        
        PID:572
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1964 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:1180
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2392 /prefetch:13
        7⤵
        
        PID:5080
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2924 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3760
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2928 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:2752
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3768 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:1720
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4068 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3588
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1840,i,6334639167521812554,12839685284237006749,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4692 /prefetch:14
        7⤵
        
        PID:4032
      - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:5088
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0x90,0x110,0x7ffa71e3c728,0x7ffa71e3c734,0x7ffa71e3c740
        7⤵
        
        PID:1864
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1884 /prefetch:2
        7⤵
        
        PID:4324
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1984 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:1004
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2108 /prefetch:13
        7⤵
        
        PID:2428
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2936 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3620
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2944 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:896
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3704 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:3292
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4040 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4600
        
        C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --force-high-res-timeticks=disabled --field-trial-handle=1888,i,15525947999524382083,9552496439556202911,262144 --disable-features=PaintHolding --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4692 /prefetch:14
        7⤵
        
        PID:3028
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --profile-directory="Default"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x254,0x258,0x25c,0x250,0x27c,0x7ffa71e1c188,0x7ffa71e1c194,0x7ffa71e1c1a0
        7⤵
        
        PID:4784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
        7⤵
        
        PID:4808
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:13
        7⤵
        
        PID:4920
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3524
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3256 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4152
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3172 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:4968
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:1500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:2460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
        7⤵
        
        PID:4164
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:14
        7⤵
        
        PID:1544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:14
        7⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --onnx-enabled-for-ee --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
        7⤵
        
        PID:5216
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
        7⤵
        
        PID:5264
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1132
        8⤵
        
        PID:5432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
        7⤵
        
        PID:2020
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
        7⤵
        
        PID:5504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2064,i,11191867778225572909,958200673350927639,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
        7⤵
        
        PID:5928
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9222 --remote-allow-origins=* --headless=new --disable-gpu --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data"
        6⤵
        Uses browser remote debugging
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        
        PID:5976
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x258,0x25c,0x260,0x254,0x170,0x7ffa71e1c188,0x7ffa71e1c194,0x7ffa71e1c1a0
        7⤵
        
        PID:6016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --headless=new --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
        7⤵
        
        PID:2316
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:11
        7⤵
        System Time Discovery
        
        PID:72
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:13
        7⤵
        
        PID:5800
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4912
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:4588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:3704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:5204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
        7⤵
        Uses browser remote debugging
        
        PID:5292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=1956,i,4140396738777398865,3780348857211423091,262144 --disable-features=PaintHolding --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:9
        7⤵
        Uses browser remote debugging
        
        PID:4376
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -ExecutionPolicy Bypass -C "& 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_p2ersalfdg1\i5rlntkr1ka.ps1' -E 'C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_p2ersalfdg1\main.exe'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:6440
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cabqsawo\cabqsawo.cmdline"
      4⤵
      PID:6036
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES188.tmp" "c:\Users\Admin\AppData\Local\Temp\cabqsawo\CSC81942FB02D5403580938DD31699CA4.TMP"
        5⤵
        
        PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_p2ersalfdg1\Unzip\main.exe
      "C:\Users\Admin\AppData\Local\Temp\MSBuildTempVS2022_p2ersalfdg1\Unzip\main.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5488
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM chrome.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1992
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM brave.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3564
    - - C:\Windows\SYSTEM32\taskkill.exe
        
        taskkill /F /IM msedge.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1868 -ip 1868
1⤵
PID:2692

C:\ProgramData\Xeno.exe
C:\ProgramData\Xeno.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\PROGRA~3\Xeno.exe
C:\PROGRA~3\Xeno.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\ProgramData\Microsoft\Runtime Broker.exe
"C:\ProgramData\Microsoft\Runtime Broker.exe"
1⤵
- Suricata alert: REMCOS RAT Malware Inbound C2 Communication
- Suricata alert: REMCOS RAT Malware Outbound C2 Communication
- Adds policy Run key to start application
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3632
- \??\c:\program files (x86)\microsoft\edge\application\msedge.exe
  "c:\program files (x86)\microsoft\edge\application\msedge.exe"
  2⤵
  PID:2824
- C:\Windows\SysWOW64\svchost.exe
  svchost.exe
  2⤵
  PID:1708

C:\ProgramData\Xeno.exe
C:\ProgramData\Xeno.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2536

C:\ProgramData\Xeno.exe
C:\ProgramData\Xeno.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:488

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5484

C:\ProgramData\Xeno.exe
C:\ProgramData\Xeno.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Modify Authentication Process

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process