njrat | hxxps://github[.]com/Return32/return-/blob/main/0x32[.]exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70924616d240d4b88ce9dc9a796c4181.exe	0x32.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\70924616d240d4b88ce9dc9a796c4181.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\70924616d240d4b88ce9dc9a796c4181.exe	0x32.exe

Executes dropped EXE 8 IoCs

pid	Process
5432	0x32.exe
956	0x32.exe
5032	0x32.exe
6372	0x32.exe
6464	0x32.exe
6536	0x32.exe
6676	0x32.exe
6800	0x32.exe

Loads dropped DLL 2 IoCs

pid	Process
1344	msedge.exe
7916	msedge.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\70924616d240d4b88ce9dc9a796c4181 = "\"C:\\Users\\Admin\\Downloads\\0x32.exe\" .."	0x32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\70924616d240d4b88ce9dc9a796c4181 = "\"C:\\Users\\Admin\\Downloads\\0x32.exe\" .."	0x32.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5544	powershell.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
29	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\v:	SearchIndexer.exe
File opened (read-only)	\??\r:	SearchIndexer.exe
File opened (read-only)	\??\t:	SearchIndexer.exe
File opened (read-only)	\??\w:	SearchIndexer.exe
File opened (read-only)	\??\X:	SearchIndexer.exe
File opened (read-only)	\??\y:	SearchIndexer.exe
File opened (read-only)	\??\I:	SearchIndexer.exe
File opened (read-only)	\??\E:	SearchIndexer.exe
File opened (read-only)	\??\h:	SearchIndexer.exe
File opened (read-only)	\??\H:	SearchIndexer.exe
File opened (read-only)	\??\K:	SearchIndexer.exe
File opened (read-only)	\??\m:	SearchIndexer.exe
File opened (read-only)	\??\N:	SearchIndexer.exe
File opened (read-only)	\??\s:	SearchIndexer.exe
File opened (read-only)	\??\D:	SearchIndexer.exe
File opened (read-only)	\??\G:	SearchIndexer.exe
File opened (read-only)	\??\P:	SearchIndexer.exe
File opened (read-only)	\??\W:	SearchIndexer.exe
File opened (read-only)	\??\z:	SearchIndexer.exe
File opened (read-only)	\??\Z:	SearchIndexer.exe
File opened (read-only)	\??\L:	SearchIndexer.exe
File opened (read-only)	\??\M:	SearchIndexer.exe
File opened (read-only)	\??\i:	SearchIndexer.exe
File opened (read-only)	\??\a:	SearchIndexer.exe
File opened (read-only)	\??\A:	SearchIndexer.exe
File opened (read-only)	\??\g:	SearchIndexer.exe
File opened (read-only)	\??\j:	SearchIndexer.exe
File opened (read-only)	\??\J:	SearchIndexer.exe
File opened (read-only)	\??\O:	SearchIndexer.exe
File opened (read-only)	\??\p:	SearchIndexer.exe
File opened (read-only)	\??\q:	SearchIndexer.exe
File opened (read-only)	\??\R:	SearchIndexer.exe
File opened (read-only)	\??\S:	SearchIndexer.exe
File opened (read-only)	\??\T:	SearchIndexer.exe
File opened (read-only)	\??\U:	SearchIndexer.exe
File opened (read-only)	\??\x:	SearchIndexer.exe
File opened (read-only)	\??\b:	SearchIndexer.exe
File opened (read-only)	\??\l:	SearchIndexer.exe
File opened (read-only)	\??\o:	SearchIndexer.exe
File opened (read-only)	\??\V:	SearchIndexer.exe
File opened (read-only)	\??\B:	SearchIndexer.exe
File opened (read-only)	\??\d:	SearchIndexer.exe
File opened (read-only)	\??\Q:	SearchIndexer.exe
File opened (read-only)	\??\u:	SearchIndexer.exe
File opened (read-only)	\??\Y:	SearchIndexer.exe
File opened (read-only)	\??\n:	SearchIndexer.exe
File opened (read-only)	\??\F:	SearchIndexer.exe
File opened (read-only)	\??\k:	SearchIndexer.exe

System Binary Proxy Execution: Verclsid 1 TTPs 1 IoCs

Adversaries may abuse Verclsid to proxy execution of malicious code.

defense_evasion

Verclsid

T1218.012

pid	Process
5448	verclsid.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	0x32.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\LogFiles\WMI\FaceUnlockManually.etl	LogonUI.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\en\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1818660272\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_830661015\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_460175361\office_endpoints_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\es\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ta\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_708485114\protocols.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1818660272\nav_config.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\or\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\sk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\da\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1880730979\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1880730979\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\te\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_708485114\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_830661015\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1439574251\domain_actions.dll	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_2132_1329091422\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_108_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\bn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1780338255\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_655754718\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_655754718\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_460175361\smart_switch_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1880730979\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\fil\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1880730979\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1692547636\arbitration_metadata.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_268895821\travel-facilitated-booking-kayak.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ne\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_655754718\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1780338255\crl-set	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\offscreendocument_main.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\et\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_1692547636\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\am\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\el\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\mn\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2132_1998969820\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1344_2071130364\manifest.json	msedge.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1372	sc.exe
5992	sc.exe
5868	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Executes a command shell one-liner 1 TTPs 64 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7796	cmd.exe
2728	cmd.exe
5880	cmd.exe
6076	cmd.exe
7416	cmd.exe
8028	cmd.exe
7668	cmd.exe
8092	cmd.exe
7792	cmd.exe
1252	cmd.exe
7760	cmd.exe
7680	cmd.exe
2684	cmd.exe
7556	cmd.exe
4252	cmd.exe
4848	cmd.exe
7940	cmd.exe
3276	cmd.exe
5620	cmd.exe
5744	cmd.exe
5336	cmd.exe
6052	cmd.exe
7448	cmd.exe
7412	cmd.exe
3468	cmd.exe
1800	cmd.exe
6344	cmd.exe
4660	cmd.exe
5944	cmd.exe
6432	cmd.exe
7996	cmd.exe
7292	cmd.exe
1144	cmd.exe
6836	cmd.exe
2384	cmd.exe
7140	cmd.exe
6992	cmd.exe
2556	cmd.exe
7236	cmd.exe
4900	cmd.exe
2876	cmd.exe
7772	cmd.exe
4296	cmd.exe
4552	cmd.exe
6628	cmd.exe
5576	cmd.exe
4176	cmd.exe
3260	cmd.exe
6924	cmd.exe
6624	cmd.exe
8036	cmd.exe
7144	cmd.exe
4388	cmd.exe
6240	cmd.exe
4928	cmd.exe
1216	cmd.exe
1992	cmd.exe
4328	cmd.exe
6356	cmd.exe
6744	cmd.exe
4648	cmd.exe
6424	cmd.exe
3088	cmd.exe
7288	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0x32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1556	chrome.exe
4424	msedge.exe
5004	msedge.exe
8044	msedge.exe

Checks SCSI registry key(s) 3 TTPs 19 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	LogonUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	LogonUI.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 64 IoCs

defense_evasion

pid	Process
2664	taskkill.exe
1252	taskkill.exe
6604	taskkill.exe
1628	taskkill.exe
6820	taskkill.exe
4436	taskkill.exe
7756	taskkill.exe
6604	taskkill.exe
6620	taskkill.exe
5788	taskkill.exe
2444	taskkill.exe
4352	taskkill.exe
1536	taskkill.exe
7824	taskkill.exe
8024	taskkill.exe
7660	taskkill.exe
4312	taskkill.exe
7424	taskkill.exe
1136	taskkill.exe
5384	taskkill.exe
6124	taskkill.exe
7784	taskkill.exe
2536	taskkill.exe
5336	taskkill.exe
3740	taskkill.exe
7976	taskkill.exe
7184	taskkill.exe
6448	taskkill.exe
7740	taskkill.exe
7276	taskkill.exe
7184	taskkill.exe
5540	taskkill.exe
7216	taskkill.exe
7244	taskkill.exe
7784	taskkill.exe
7848	taskkill.exe
5196	taskkill.exe
2652	taskkill.exe
7256	taskkill.exe
416	taskkill.exe
3468	taskkill.exe
7888	taskkill.exe
7872	taskkill.exe
5748	taskkill.exe
6604	taskkill.exe
5792	taskkill.exe
6628	taskkill.exe
6816	taskkill.exe
5084	taskkill.exe
7956	taskkill.exe
6520	taskkill.exe
7828	taskkill.exe
7268	taskkill.exe
3736	taskkill.exe
7448	taskkill.exe
5384	taskkill.exe
6160	taskkill.exe
4368	taskkill.exe
7860	taskkill.exe
1988	taskkill.exe
5568	taskkill.exe
1340	taskkill.exe
2160	taskkill.exe
1380	taskkill.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\en-US	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\mstsc.exe,-4000 = "Remote Desktop Connection"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\mstsc.exe,-4001 = "Use your computer to connect to a computer that is located elsewhere and run programs or access files."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C120DE80-FDE4-49F5-A713-E902EF062B8A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c8f7d2b90921dd01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{FBF23B40-E3F0-101B-8488-00AA003E56F8} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000001f1aba0921dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\miguiresource.dll,-102 = "View monitoring and troubleshooting messages from Windows and other programs."	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\comres.dll,-3411 = "Manage COM+ applications, COM and DCOM system configuration, and the Distributed Transaction Coordinator."	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\miguiresource.dll,-201 = "Task Scheduler"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations\LastResetTime = 124877c40921dd01	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-120 = "Microsoft Word 97 - 2003 Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aiff	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\FileAssociations	SearchIndexer.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\Taskmgr.exe,-32420 = "Task Manager"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Lighting	ctfmon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.MTS	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{AEB16279-B750-48F1-8586-97956060175A} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000bf1dc0b90921dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.DVR-MS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-182 = "Microsoft PowerPoint Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-114 = "OpenDocument Spreadsheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.aifc	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\wdc.dll,-10030 = "Resource Monitor"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{C73F6F30-97A0-4AD1-A08F-540D4E9BC7B9} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000480c65b90921dd01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\wshext.dll,-4804 = "JavaScript File"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\msconfig.exe,-6001 = "Perform advanced troubleshooting and system configuration"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\pmcsnap.dll,-700 = "Print Management"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\iscsicpl.dll,-5001 = "iSCSI Initiator"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AppDataLow\Software\Microsoft\IME\15.0\IMEJP\MSIME	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\InputMethod\Settings\CHS	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-131 = "Rich Text Format"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.avi	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mid	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\msinfo32.exe,-100 = "System Information"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\filemgmt.dll,-2204 = "Services"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@C:\Windows\system32\odbcint.dll,-1694 = "ODBC Data Sources (64-bit)"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%windir%\system32\odbcint.dll,-1312 = "Maintains ODBC data sources and drivers."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000dc9d95fb0921dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.TS\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\Msinfo32.exe,-130 = "Display detailed information about your computer."	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c44f7ffb0921dd01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Input\Settings	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8 = 14001f481cffcda87848be43b5fdf8091c1c60d00000	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0200000005000000070000000300000006000000040000000100000000000000ffffffff	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0\0\MRUListEx = ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell\SniffedFolderType = "Documents"	vlc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{F8CCF5DA-5653-4AB0-90B0-17E1D499ADEF}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0\NodeSlot = "14"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\MRUListEx = 00000000ffffffff	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\15\Shell	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac04000000c8000000354b179bff40d211a27e00c04fc308710300000080000000354b179bff40d211a27e00c04fc308710200000080000000	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	mspaint.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24ad3ad4-a569-4530-98e1-ab02f9417aa8}\Instance\	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0\0	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\14\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Downloads"	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{f86fa3ab-70d2-4fc7-9c99-fcbf05467f3a}\Instance\	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d3162b92-9365-467a-956b-92703aca08af}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	mspaint.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\8\0\0\NodeSlot = "15"	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	mspaint.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "2"	mspaint.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3dfdf296-dbec-4fb4-81d1-6a3438bcf4de}\Instance\	mspaint.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 080000000200000005000000070000000300000006000000040000000100000000000000ffffffff	vlc.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\13\ComDlg	vlc.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
6176	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5684	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
5544	powershell.exe
5544	powershell.exe
5544	powershell.exe
2880	chrome.exe
2880	chrome.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe
5432	0x32.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5432	0x32.exe
5684	vlc.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
7916	msedge.exe
7916	msedge.exe
7916	msedge.exe
7916	msedge.exe
7916	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe
Token: SeShutdownPrivilege	2880	chrome.exe
Token: SeCreatePagefilePrivilege	2880	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
5684	vlc.exe
5684	vlc.exe
5684	vlc.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2880	chrome.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
5684	vlc.exe
5684	vlc.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe
3196	taskmgr.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
6608	mspaint.exe
6608	mspaint.exe
6608	mspaint.exe
6608	mspaint.exe
6608	mspaint.exe
6700	mspaint.exe
6700	mspaint.exe
6700	mspaint.exe
6700	mspaint.exe
6700	mspaint.exe
4504	mspaint.exe
4504	mspaint.exe
4504	mspaint.exe
4504	mspaint.exe
1432	ShellHost.exe
5684	vlc.exe
5684	vlc.exe
3196	taskmgr.exe
6768	mspaint.exe
6768	mspaint.exe
6768	mspaint.exe
6768	mspaint.exe
5744	PickerHost.exe
5788	LogonUI.exe
5788	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2776	2880	chrome.exe	88
PID 2880 wrote to memory of 4236	2880	chrome.exe	89
PID 2880 wrote to memory of 4236	2880	chrome.exe	89
PID 2880 wrote to memory of 1556	2880	chrome.exe	90
PID 2880 wrote to memory of 4148	2880	chrome.exe	91
PID 2880 wrote to memory of 4148	2880	chrome.exe	91
PID 2880 wrote to memory of 5224	2880	chrome.exe	93
PID 2880 wrote to memory of 5892	2880	chrome.exe	94
PID 2880 wrote to memory of 5224	2880	chrome.exe	93
PID 2880 wrote to memory of 5892	2880	chrome.exe	94
PID 2880 wrote to memory of 3404	2880	chrome.exe	96
PID 2880 wrote to memory of 564	2880	chrome.exe	99
PID 2880 wrote to memory of 2580	2880	chrome.exe	98
PID 2880 wrote to memory of 564	2880	chrome.exe	99
PID 2880 wrote to memory of 2580	2880	chrome.exe	98
PID 2880 wrote to memory of 1656	2880	chrome.exe	100
PID 2880 wrote to memory of 1656	2880	chrome.exe	100
PID 2880 wrote to memory of 3148	2880	chrome.exe	101
PID 2880 wrote to memory of 3148	2880	chrome.exe	101
PID 2880 wrote to memory of 4296	2880	chrome.exe	102
PID 2880 wrote to memory of 4296	2880	chrome.exe	102
PID 2880 wrote to memory of 5360	2880	chrome.exe	103
PID 2880 wrote to memory of 5360	2880	chrome.exe	103
PID 2880 wrote to memory of 4844	2880	chrome.exe	104
PID 2880 wrote to memory of 4844	2880	chrome.exe	104
PID 2880 wrote to memory of 3596	2880	chrome.exe	105
PID 2880 wrote to memory of 3596	2880	chrome.exe	105
PID 2880 wrote to memory of 3096	2880	chrome.exe	108
PID 2880 wrote to memory of 5368	2880	chrome.exe	110
PID 2880 wrote to memory of 3820	2880	chrome.exe	111
PID 2880 wrote to memory of 5536	2880	chrome.exe	112
PID 2880 wrote to memory of 5432	2880	chrome.exe	113
PID 5432 wrote to memory of 3192	5432	0x32.exe	114
PID 3192 wrote to memory of 5544	3192	cmd.exe	116
PID 5432 wrote to memory of 3096	5432	0x32.exe	119
PID 3096 wrote to memory of 1372	3096	cmd.exe	121
PID 5432 wrote to memory of 3300	5432	0x32.exe	122
PID 3300 wrote to memory of 5992	3300	cmd.exe	124
PID 5432 wrote to memory of 3348	5432	0x32.exe	125
PID 3348 wrote to memory of 5868	3348	cmd.exe	127
PID 2880 wrote to memory of 680	2880	chrome.exe	135
PID 2132 wrote to memory of 4072	2132	msedge.exe	137
PID 2132 wrote to memory of 4424	2132	msedge.exe	138
PID 2132 wrote to memory of 5032	2132	msedge.exe	139
PID 2132 wrote to memory of 5032	2132	msedge.exe	139
PID 2132 wrote to memory of 5032	2132	msedge.exe	139
PID 2132 wrote to memory of 4544	2132	msedge.exe	140
PID 2132 wrote to memory of 4544	2132	msedge.exe	140
PID 2132 wrote to memory of 4032	2132	msedge.exe	141
PID 2132 wrote to memory of 4032	2132	msedge.exe	141
PID 2132 wrote to memory of 4032	2132	msedge.exe	141
PID 2132 wrote to memory of 4652	2132	msedge.exe	142
PID 2132 wrote to memory of 4652	2132	msedge.exe	142
PID 2132 wrote to memory of 4652	2132	msedge.exe	142
PID 2132 wrote to memory of 2920	2132	msedge.exe	144
PID 2132 wrote to memory of 1372	2132	msedge.exe	145
PID 2132 wrote to memory of 2920	2132	msedge.exe	144
PID 2132 wrote to memory of 2920	2132	msedge.exe	144
PID 2132 wrote to memory of 1372	2132	msedge.exe	145
PID 2132 wrote to memory of 1372	2132	msedge.exe	145
PID 2132 wrote to memory of 5844	2132	msedge.exe	146
PID 2132 wrote to memory of 5844	2132	msedge.exe	146
PID 2132 wrote to memory of 2652	2132	msedge.exe	147
PID 2132 wrote to memory of 2652	2132	msedge.exe	147

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Return32/return-/blob/main/0x32.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff85115c728,0x7ff85115c734,0x7ff85115c740
  2⤵
  PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,15595935452764948536,13417898960994562199,262144 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2188,i,111726493699355513,5748566679197498922,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2332,i,13693563212127301930,12634652652825184812,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:13
  2⤵
  PID:4148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3212,i,15811657407739476186,18110480331541852227,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3216,i,12015717344517075455,10046261981714086950,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:5892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5496,i,2372492928297320404,10249726341476344919,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5604,i,846804141605425368,2969283225911569744,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5616,i,6630903598496425345,3961919190048289165,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5948,i,14258083043047105258,4542310553218804858,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=6084,i,13063278540123869577,4294538886746248743,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=6072,i,3102451650736593736,15607975902709881577,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6092,i,5125199482708115191,1848860392481907466,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6064,i,8788846677315231397,1645218902194475975,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6588,i,966435304965178628,11705798572197113681,2097152 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5144,i,14384151953993257508,18234869411716113646,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4904,i,15008740892024538355,7371980268839146193,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:5368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,6983275347726947044,17401059138382269314,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6576,i,1426749171919310935,2189777206329213115,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:5536
- C:\Users\Admin\Downloads\0x32.exe
  "C:\Users\Admin\Downloads\0x32.exe"
  2⤵
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:5432
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Set-MpPreference -DisableRealtimeMonitoring $true
      4⤵
      Disables one or more Microsoft Defender components
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5544
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c sc query windefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\SysWOW64\sc.exe
      sc query windefend
      4⤵
      Launches sc.exe
      PID:1372
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c sc stop windefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3300
  - - C:\Windows\SysWOW64\sc.exe
      sc stop windefend
      4⤵
      Launches sc.exe
      PID:5992
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c sc delete windefend
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3348
  - - C:\Windows\SysWOW64\sc.exe
      sc delete windefend
      4⤵
      Launches sc.exe
      PID:5868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    - Executes a command shell one-liner
    PID:6344
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      PID:6908
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    - Executes a command shell one-liner
    PID:7144
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      PID:6696
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    - Executes a command shell one-liner
    PID:4328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6908
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      PID:1568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    PID:2632
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    - Executes a command shell one-liner
    PID:4928
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      Kills process with taskkill
      PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      PID:3140
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    - Executes a command shell one-liner
    PID:5880
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    PID:4852
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      Kills process with taskkill
      PID:1136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2500
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5336
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    - Executes a command shell one-liner
    PID:6992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    - Executes a command shell one-liner
    PID:1144
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      PID:6628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    - Executes a command shell one-liner
    PID:3088
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      Kills process with taskkill
      PID:1252
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    - Executes a command shell one-liner
    PID:4660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      PID:6468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2804
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      Kills process with taskkill
      PID:3740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4552
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      PID:3024
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    - Executes a command shell one-liner
    PID:4388
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    PID:7160
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7064
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    PID:2372
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      PID:5204
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    PID:6912
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      Kills process with taskkill
      PID:6628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    - Executes a command shell one-liner
    PID:6424
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      PID:6332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    - Executes a command shell one-liner
    PID:6356
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      Kills process with taskkill
      PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    - Executes a command shell one-liner
    PID:3276
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      Kills process with taskkill
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      PID:6124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    PID:6896
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      Kills process with taskkill
      PID:1536
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    - Executes a command shell one-liner
    PID:6836
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      Kills process with taskkill
      PID:6820
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    PID:7060
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      PID:6448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    PID:6336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2384
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      Kills process with taskkill
      PID:6160
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    - Executes a command shell one-liner
    PID:6628
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    PID:4456
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      PID:4308
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5828
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      PID:6512
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    PID:6216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      PID:1872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    PID:6240
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    PID:6936
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      PID:6332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    - Executes a command shell one-liner
    PID:1216
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      Kills process with taskkill
      PID:2160
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    PID:5744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      Kills process with taskkill
      PID:5384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3476
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      Kills process with taskkill
      PID:6604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    PID:4468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      PID:7148
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    PID:5576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      PID:6620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    - Executes a command shell one-liner
    PID:4176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      Kills process with taskkill
      PID:6816
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3260
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:1628
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3468
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      Kills process with taskkill
      PID:416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2564
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4656
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6612
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    PID:5480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      Kills process with taskkill
      PID:2652
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    PID:3492
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:6124
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    PID:4760
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      PID:6604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    PID:5368
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      System Location Discovery: System Language Discovery
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    PID:5256
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      Kills process with taskkill
      PID:5788
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    - Executes a command shell one-liner
    PID:5336
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4916
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - Executes a command shell one-liner
    PID:6924
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      PID:6348
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    PID:1628
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      PID:2452
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown -a
    3⤵
    PID:3168
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -a
      4⤵
      PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - Executes a command shell one-liner
    PID:6076
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6512
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    - Executes a command shell one-liner
    PID:2556
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6604
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:5384
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown -a
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6124
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -a
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - Executes a command shell one-liner
    PID:1252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    PID:3332
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      Kills process with taskkill
      PID:7244
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown -a
    3⤵
    - Executes a command shell one-liner
    PID:6052
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -a
      4⤵
      PID:7188
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown -a
    3⤵
    PID:2064
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -a
      4⤵
      PID:6456
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown -a
    3⤵
    PID:2652
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -a
      4⤵
      System Location Discovery: System Language Discovery
      PID:7364
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    - Executes a command shell one-liner
    PID:1992
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      Kills process with taskkill
      PID:7424
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7196
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      PID:7400
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    PID:7228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:7448
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown -a
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:7236
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown -a
      4⤵
      System Location Discovery: System Language Discovery
      PID:7440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    - Executes a command shell one-liner
    PID:7416
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      PID:7612
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    PID:7548
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      Kills process with taskkill
      PID:7740
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    PID:7640
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:7888
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    PID:7648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      PID:7872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    - Executes a command shell one-liner
    PID:7760
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:7976
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    - Executes a command shell one-liner
    PID:7772
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7984
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    - Executes a command shell one-liner
    PID:7796
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      PID:8004
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rundll32.exe user32.dll,LockWorkStation
    3⤵
    PID:8056
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe user32.dll,LockWorkStation
      4⤵
      PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    PID:8132
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:5084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    PID:8164
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      Kills process with taskkill
      PID:1380
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    PID:8176
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7408
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rundll32.exe user32.dll,LockWorkStation
    3⤵
    PID:5424
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe user32.dll,LockWorkStation
      4⤵
      System Location Discovery: System Language Discovery
      PID:6520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    - Executes a command shell one-liner
    PID:7288
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:7184
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c rundll32.exe user32.dll,LockWorkStation
    3⤵
    PID:4024
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe user32.dll,LockWorkStation
      4⤵
      PID:7676
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6624
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:7276
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    PID:2764
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      Kills process with taskkill
      PID:7784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    PID:7368
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:7140
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      Kills process with taskkill
      PID:7756
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7748
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      Kills process with taskkill
      PID:7216
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    PID:7712
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      PID:7868
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    - Executes a command shell one-liner
    PID:7668
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      Kills process with taskkill
      PID:7828
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - Executes a command shell one-liner
    PID:8028
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      Kills process with taskkill
      PID:7848
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    PID:8004
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6576
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      PID:8084
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:8092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      Kills process with taskkill
      PID:7956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    - Executes a command shell one-liner
    PID:7680
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:7268
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - Executes a command shell one-liner
    PID:7996
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      Kills process with taskkill
      PID:7872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    - Executes a command shell one-liner
    PID:7292
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    - Executes a command shell one-liner
    PID:7448
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:7784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    PID:1480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      PID:8032
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:7792
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      PID:6724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    PID:4364
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      Kills process with taskkill
      PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    PID:8184
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      Kills process with taskkill
      PID:7660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:7556
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      Kills process with taskkill
      PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    PID:7820
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      Kills process with taskkill
      PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    PID:7876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      PID:7632
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    PID:7268
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1536
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      PID:7664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    - Executes a command shell one-liner
    PID:2684
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      Kills process with taskkill
      PID:6520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
    3⤵
    PID:7872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
    3⤵
    PID:7904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
    3⤵
    PID:7596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
    3⤵
    - Loads dropped DLL
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:7916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff83aa6c188,0x7ff83aa6c194,0x7ff83aa6c1a0
      4⤵
      PID:7148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,6773960084098221104,6708341647143156908,524288 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:11
      4⤵
      System Time Discovery
      PID:8044
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1980,i,12056728551144769273,7462289686848391162,262144 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:2
      4⤵
      PID:6332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10071695015964792133,731661594378387385,2097152 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
      4⤵
      PID:5540
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,16531068109969366404,15147117619445527906,2097152 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:6152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,13902505176532439741,1913751248955917878,524288 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:13
      4⤵
      PID:7744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,14431288292884000092,1822106938719935943,2097152 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4360,i,16018989711745363587,822014706115102041,2097152 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
      4⤵
      PID:1392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3468,i,6113734556941055354,4961708948344600526,2097152 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
      4⤵
      PID:2112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8031257715347639242,5845021429211288801,524288 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
      4⤵
      PID:7756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,13530740774061485040,4348704411643986067,524288 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
      4⤵
      PID:7608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,4265766470974503912,13162660564233961544,524288 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:7504
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,4265766470974503912,13162660564233961544,524288 --field-trial-handle=2748,i,9657138667942270539,6529962955226951144,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
      4⤵
      PID:5844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://google.com/
    3⤵
    PID:4416
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    PID:4100
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    - Executes a command shell one-liner
    PID:4296
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      PID:4784
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    - Executes a command shell one-liner
    PID:8036
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      PID:1748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    PID:7728
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      Kills process with taskkill
      PID:5748
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    PID:7412
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    PID:4516
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      PID:7860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - Executes a command shell one-liner
    PID:1800
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    PID:5864
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      Kills process with taskkill
      PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    - Executes a command shell one-liner
    PID:6432
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:6604
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    PID:2316
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      Kills process with taskkill
      PID:7256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:6744
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      PID:8
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7192
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      PID:2912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    - Executes a command shell one-liner
    PID:4648
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      PID:2116
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chrome.exe
    3⤵
    PID:6872
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chrome.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7488
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Firefox.exe
    3⤵
    PID:6080
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Firefox.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:7824
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Chromium.exe
    3⤵
    PID:4232
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Chromium.exe
      4⤵
      PID:2540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Opera.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3496
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Opera.exe
      4⤵
      Kills process with taskkill
      PID:7184
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im OperaGX.exe
    3⤵
    - Executes a command shell one-liner
    PID:4252
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im OperaGX.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:7860
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im MsEdge.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4900
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MsEdge.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:5792
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Safari.exe
    3⤵
    - Executes a command shell one-liner
    PID:4848
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Safari.exe
      4⤵
      PID:7272
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Brave.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1328
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Brave.exe
      4⤵
      Kills process with taskkill
      PID:1988
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Iridium.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2876
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Iridium.exe
      4⤵
      Kills process with taskkill
      PID:3736
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Dissenter.exe
    3⤵
    PID:7620
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:1380
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Dissenter.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:8024
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im PaleMoon.exe
    3⤵
    PID:7308
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im PaleMoon.exe
      4⤵
      Kills process with taskkill
      PID:5568
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im Vivaldi.exe
    3⤵
    PID:7856
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Vivaldi.exe
      4⤵
      PID:7264
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c taskkill /f /im iExplore.exe
    3⤵
    - Executes a command shell one-liner
    PID:7940
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im iExplore.exe
      4⤵
      Kills process with taskkill
      PID:5196
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    PID:7544
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      PID:3724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c shutdown /s /f /t 60
    3⤵
    PID:4616
  - - C:\Windows\SysWOW64\shutdown.exe
      shutdown /s /f /t 60
      4⤵
      PID:2536
- - C:\Users\Admin\AppData\Local\Temp\b643a08f60f74bafbfcef4b0387a24ff.exe
    "C:\Users\Admin\AppData\Local\Temp\b643a08f60f74bafbfcef4b0387a24ff.exe"
    3⤵
    PID:8012
- - C:\Users\Admin\AppData\Local\Temp\79dd63ec0712406db081398d8e61a851.exe
    "C:\Users\Admin\AppData\Local\Temp\79dd63ec0712406db081398d8e61a851.exe"
    3⤵
    PID:5812
- - C:\Users\Admin\AppData\Local\Temp\3cf4382455c5456a826dd3d406688cd2.exe
    "C:\Users\Admin\AppData\Local\Temp\3cf4382455c5456a826dd3d406688cd2.exe"
    3⤵
    PID:7564
- - C:\Users\Admin\AppData\Local\Temp\b7ba50edc1e3426487504390cb4884be.exe
    "C:\Users\Admin\AppData\Local\Temp\b7ba50edc1e3426487504390cb4884be.exe"
    3⤵
    PID:6596
- - C:\Users\Admin\AppData\Local\Temp\99555523ce7a4f12b25dd8edffce4ad6.exe
    "C:\Users\Admin\AppData\Local\Temp\99555523ce7a4f12b25dd8edffce4ad6.exe"
    3⤵
    PID:2420
- - C:\Users\Admin\AppData\Local\Temp\f9f956ec289345a4a63ab186186bab27.exe
    "C:\Users\Admin\AppData\Local\Temp\f9f956ec289345a4a63ab186186bab27.exe"
    3⤵
    PID:6428
- - C:\Users\Admin\AppData\Local\Temp\0a55a0a33f1b49c3a9046b920f442cba.exe
    "C:\Users\Admin\AppData\Local\Temp\0a55a0a33f1b49c3a9046b920f442cba.exe"
    3⤵
    PID:2428
- - C:\Users\Admin\AppData\Local\Temp\832cb74c483a4b6287ab19000b26cda7.exe
    "C:\Users\Admin\AppData\Local\Temp\832cb74c483a4b6287ab19000b26cda7.exe"
    3⤵
    PID:7888
- - C:\Users\Admin\AppData\Local\Temp\f15a4155ee394e98836d11e75d64cd2c.exe
    "C:\Users\Admin\AppData\Local\Temp\f15a4155ee394e98836d11e75d64cd2c.exe"
    3⤵
    PID:6200
- - C:\Users\Admin\AppData\Local\Temp\761e8657f50c41938b0ba5ec4a75d1c8.exe
    "C:\Users\Admin\AppData\Local\Temp\761e8657f50c41938b0ba5ec4a75d1c8.exe"
    3⤵
    PID:4072
- - C:\Users\Admin\AppData\Local\Temp\3877df8fde7b4217a06af33b66844787.exe
    "C:\Users\Admin\AppData\Local\Temp\3877df8fde7b4217a06af33b66844787.exe"
    3⤵
    PID:896
- - C:\Users\Admin\AppData\Local\Temp\597db16e7e9543138e791afd83231932.exe
    "C:\Users\Admin\AppData\Local\Temp\597db16e7e9543138e791afd83231932.exe"
    3⤵
    PID:6948
- - C:\Users\Admin\AppData\Local\Temp\72fe11ca7467457eb26f00ad4a672970.exe
    "C:\Users\Admin\AppData\Local\Temp\72fe11ca7467457eb26f00ad4a672970.exe"
    3⤵
    PID:6560
- - C:\Users\Admin\AppData\Local\Temp\d1b78f7bde734e7b93f404ba62322631.exe
    "C:\Users\Admin\AppData\Local\Temp\d1b78f7bde734e7b93f404ba62322631.exe"
    3⤵
    PID:7520
- - C:\Users\Admin\AppData\Local\Temp\169c1235bc104eb08608719175287d6c.exe
    "C:\Users\Admin\AppData\Local\Temp\169c1235bc104eb08608719175287d6c.exe"
    3⤵
    PID:2572
- - C:\Users\Admin\AppData\Local\Temp\24d25ce88b654c8c95fc2895547727f8.exe
    "C:\Users\Admin\AppData\Local\Temp\24d25ce88b654c8c95fc2895547727f8.exe"
    3⤵
    PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4996,i,15878026967154755580,758443633673796389,262144 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:10
  2⤵
  PID:680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4564,i,4226086044973200214,9490724990630642625,524288 --field-trial-handle=1928,i,6338963463144742408,8658417237638961489,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:5548

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3324

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5956

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:3700

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4176

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe" ..
1⤵
- Executes dropped EXE
PID:956

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe"
1⤵
- Executes dropped EXE
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Pictures\DismountSwitch.svg
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x300,0x7ff83aa6c188,0x7ff83aa6c194,0x7ff83aa6c1a0
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2172,i,3672980573259354907,9344033950821579384,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1988,i,8596941452601687306,12310107185923285226,262144 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,7112578640959046398,10701814599619626598,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,15471035408618904747,1726855710870904013,2097152 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,17298440986222712477,10400092151026062109,2097152 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,17513822591299842112,4345434240443104482,2097152 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:9
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17141750457654890664,5836213751648306349,2097152 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4189242561300049311,7316486215864371965,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:14
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,12752924911581841108,2721484037562605067,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,15932917708493780636,2460735601518176888,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,9369468742082446163,14803592367486718021,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,9369468742082446163,14803592367486718021,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,7174203002692107014,11236279547616178263,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,16910561511898484605,7612110647703797012,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,5139689636715827881,16382536729417585019,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,10789696532488706418,9265864340985802657,524288 --field-trial-handle=2460,i,17668602916334491816,17718272336649448275,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - Enumerates system info in registry
  - Modifies registry class
  PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff83aa6c188,0x7ff83aa6c194,0x7ff83aa6c1a0
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,2710313100498451617,6611734157610126170,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:11
    3⤵
    - System Time Discovery
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,1786382511770078677,5109762991598304604,262144 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,7380766204040451925,14677563731997592484,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:13
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,11279029774958551989,17343602370614444579,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,11279029774958551989,17343602370614444579,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:14
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,9892730960353806958,4849016933396158481,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
    3⤵
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,7691404630142816922,8735742687673736830,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:14
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,5582147467284459731,1293627830056370405,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,7690255762022206379,8460991535657502102,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
    3⤵
    PID:6396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,13171777513145787424,9012408324901870926,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
    3⤵
    PID:6852
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,2226769225491090572,2708498393789038836,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:14
    3⤵
    PID:6312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5008,i,10176531431589610608,8177499292894558377,262144 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:10
    3⤵
    PID:6436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,6612680647066644333,16779781463323573920,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:14
    3⤵
    PID:6512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,3814144987814738439,10630194193131771649,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
    3⤵
    PID:6936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3120,i,2331045332694855129,6249195611584336875,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,10494735579126041809,15680463243613650699,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:14
    3⤵
    PID:1592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4347794828936979358,13584154405160821602,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12591936197809510692,16405099680795375047,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:14
    3⤵
    PID:3736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,5013495801895979972,12233012608845038449,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:14
    3⤵
    PID:6972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=816,i,1424398016516381596,17183288988187250579,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
    3⤵
    PID:4744
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,4607347122493922337,11196573976104787246,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:14
    3⤵
    PID:5140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,5522684947474890446,47874285300710078,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
    3⤵
    PID:6884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,11471658682459236006,4212895033999947730,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:14
    3⤵
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14928625100728999206,16080853771371758373,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
    3⤵
    PID:6672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=812,i,6295634377973506749,10261015237520448088,524288 --field-trial-handle=2340,i,11681057255055169707,4738224346942404421,262144 --variations-seed-version --mojo-platform-channel-handle=3168 /prefetch:14
    3⤵
    PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost
1⤵
PID:2524

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Enumerates connected drives
- Modifies data under HKEY_USERS
PID:792
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4284
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
  2⤵
  PID:4692
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 844 1480 1492 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4220
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 844 2480 1780 820 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
  2⤵
  - Modifies data under HKEY_USERS
  PID:4612
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:4176
- C:\Windows\System32\SearchFilterHost.exe
  "C:\Windows\System32\SearchFilterHost.exe" 844 1480 1492 820 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
  2⤵
  PID:3572
- C:\Windows\System32\SearchProtocolHost.exe
  "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe4_ Global\UsGthrCtrlFltPipeMssGthrPipe4 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  PID:1588

C:\Windows\system32\verclsid.exe
"C:\Windows\system32\verclsid.exe" /S /C {9E175B8B-F52A-11D8-B9A5-505054503030} /I {0C733A8A-2A1C-11CE-ADE5-00AA0044773D} /X 0x401
1⤵
- System Binary Proxy Execution: Verclsid
PID:5448

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6372

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe"
1⤵
- Executes dropped EXE
PID:6464

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe"
1⤵
- Executes dropped EXE
PID:6536

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe"
1⤵
- Executes dropped EXE
PID:6676

C:\Users\Admin\Downloads\0x32.exe
"C:\Users\Admin\Downloads\0x32.exe"
1⤵
- Executes dropped EXE
PID:6800

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\virus.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:6176

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:2664

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6700

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Downloads\Untitled.png"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:6000

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:4904

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x00000000000004CC
1⤵
PID:3792

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1432

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5684

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Creates a file in the Startup directory
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3196

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:6768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:3848

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5744

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3024

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3fb8855 /state1:0x41c64e6d
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:7592

C:\Windows\system32\ctfmon.exe
/QuitInfo:000000000000023C;00000000000001B0;
1⤵
- Modifies data under HKEY_USERS
PID:7852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2108

C:\Windows\system32\utilman.exe
utilman.exe /debug
1⤵
PID:6656
- C:\Windows\System32\Magnify.exe
  "C:\Windows\System32\Magnify.exe"
  2⤵
  PID:1632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

System Binary Proxy Execution

T1218

Verclsid

T1218.012

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery