metasploit | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Windows Service

T1543.003

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	finale.exe

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	finale.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Wcd3e5c96 = "0"	finale.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5000	powershell.exe
4172	powershell.exe

Disables one or more Microsoft Defender components 1 TTPs 1 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

defense_evasion

Disable or Modify Tools

credential_access stealer

pid	Process
4172	powershell.exe

Downloads MZ/PE file 16 IoCs

flow	pid	Process
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
13	4252	4363463463464363463463463.exe
83	4252	4363463463464363463463463.exe
79	4252	4363463463464363463463463.exe
16	4252	4363463463464363463463463.exe
35	4252	4363463463464363463463463.exe
39	4252	4363463463464363463463463.exe
100	4252	4363463463464363463463463.exe

Signed with revoked ConnectWise certificate 2 IoCs

Binary is signed using a ConnectWise certificate revoked for key compromise.

revoked_codesign

resource	yara_rule
behavioral3/files/0x00080000000244dd-804.dat	revoked_cert_connectwise
behavioral3/memory/2612-807-0x0000000005DD0000-0x00000000060C2000-memory.dmp	revoked_cert_connectwise

Uses browser remote debugging 2 TTPs 10 IoCs

Can be used to control the browser and steal sensitive information such as credentials and session cookies.

Steal Web Session Cookie

T1539

Modify Authentication Process

pid	Process
3808	chrome.exe
1292	chrome.exe
4684	chrome.exe
4928	chrome.exe
1840	chrome.exe
3196	chrome.exe
1776	chrome.exe
820	chrome.exe
1680	chrome.exe
1776	chrome.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	4363463463464363463463463.exe

Executes dropped EXE 16 IoCs

pid	Process
4564	SharpHound.exe
3648	doitallmain.exe
3232	Complexo%20v4.exe
1740	IATInfect2008_64.exe
452	finale.exe
4400	CFXBypass.exe
5100	winsetaccess64.exe
3372	UrbanVPN.exe
1104	main.exe
1808	x64-setup.exe
1784	main.exe
3120	plantrojan.exe
3468	wrm.exe
5076	file_b584670f7ec2f317.exe
4804	wrm.exe
4188	Anap.a.exe

Loads dropped DLL 64 IoCs

pid	Process
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
1784	main.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe
4804	wrm.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 3 IoCs

defense_evasion trojan

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\Wcd3e5c96 = "0"	finale.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	finale.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions	finale.exe

Checks for any installed AV software in registry 1 TTPs 12 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	finale.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Exclusions\f20d3b81-2923-46fb-9a73-719e1f8639ac = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Wcd3e5c96"	finale.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab\Exclusions	finale.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab\Exclusions	finale.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab\Exclusions\66aed56e-1479-45a3-9e61-6d803e7db117 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Wcd3e5c96"	finale.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Exclusions	finale.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	finale.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Exclusions\f20d3b81-2923-46fb-9a73-719e1f8639ac	finale.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab	finale.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab	finale.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\KasperskyLab\Exclusions\66aed56e-1479-45a3-9e61-6d803e7db117	finale.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Exclusions	finale.exe

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
12	raw.githubusercontent.com
13	raw.githubusercontent.com
45	pastebin.com

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
118	ip-addr.es
120	ip-addr.es

Discovers running processes 1 TTPs 20 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
3440	tasklist.exe
4644	tasklist.exe
4852	tasklist.exe
2152	tasklist.exe
448	tasklist.exe
800	tasklist.exe
4228	tasklist.exe
696	tasklist.exe
3660	tasklist.exe
316	tasklist.exe
2360	tasklist.exe
1396	tasklist.exe
1472	tasklist.exe
1244	tasklist.exe
3308	tasklist.exe
4880	tasklist.exe
2744	tasklist.exe
3816	tasklist.exe
4864	tasklist.exe
4264	tasklist.exe

Costura .NET executable packer 1 IoCs

Costura packer aka Costura Fody, is an add-in for the .NET framework that embeds all external dependency .dll files as resources inside main executable.

costura packer

resource	yara_rule
behavioral3/files/0x0008000000024481-7.dat	costura

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral3/files/0x0007000000016805-129.dat	pyinstaller
behavioral3/files/0x000f0000000244d3-302.dat	pyinstaller
behavioral3/files/0x00070000000245ef-567.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 20 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2460	cmd.exe
4180	cmd.exe
2332	cmd.exe
4432	cmd.exe
1168	cmd.exe
2788	cmd.exe
4788	cmd.exe
3644	cmd.exe
464	cmd.exe
1716	cmd.exe
4728	cmd.exe
4644	cmd.exe
4848	cmd.exe
3856	cmd.exe
1988	cmd.exe
1508	cmd.exe
2780	cmd.exe
4308	cmd.exe
3980	cmd.exe
1880	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4363463463464363463463463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	doitallmain.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	UrbanVPN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	plantrojan.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Anap.a.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
3692	chrome.exe
4060	chrome.exe
3352	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
4788	taskkill.exe
4440	taskkill.exe
3660	taskkill.exe
4804	taskkill.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4400	CFXBypass.exe
4172	powershell.exe
4172	powershell.exe
5000	powershell.exe
5000	powershell.exe
1808	x64-setup.exe
1808	x64-setup.exe
1292	chrome.exe
1292	chrome.exe
1808	x64-setup.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	4363463463464363463463463.exe
Token: SeDebugPrivilege	452	finale.exe
Token: SeDebugPrivilege	4400	CFXBypass.exe
Token: SeDebugPrivilege	4172	powershell.exe
Token: SeDebugPrivilege	5000	powershell.exe
Token: SeDebugPrivilege	4788	taskkill.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeShutdownPrivilege	1292	chrome.exe
Token: SeCreatePagefilePrivilege	1292	chrome.exe
Token: SeDebugPrivilege	4804	wrm.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1292	chrome.exe
1292	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3648	doitallmain.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4564	4252	4363463463464363463463463.exe	86
PID 4252 wrote to memory of 3648	4252	4363463463464363463463463.exe	88
PID 4252 wrote to memory of 3232	4252	4363463463464363463463463.exe	94
PID 4252 wrote to memory of 1740	4252	4363463463464363463463463.exe	98
PID 4252 wrote to memory of 452	4252	4363463463464363463463463.exe	100
PID 4252 wrote to memory of 4400	4252	4363463463464363463463463.exe	101
PID 4252 wrote to memory of 5100	4252	4363463463464363463463463.exe	102
PID 452 wrote to memory of 4172	452	finale.exe	103
PID 452 wrote to memory of 5000	452	finale.exe	105
PID 4252 wrote to memory of 3372	4252	4363463463464363463463463.exe	107
PID 4252 wrote to memory of 1104	4252	4363463463464363463463463.exe	109
PID 4252 wrote to memory of 1808	4252	4363463463464363463463463.exe	110
PID 1104 wrote to memory of 1784	1104	main.exe	111
PID 4252 wrote to memory of 3120	4252	4363463463464363463463463.exe	112
PID 1784 wrote to memory of 4788	1784	main.exe	113
PID 1784 wrote to memory of 1292	1784	main.exe	115
PID 1292 wrote to memory of 1048	1292	chrome.exe	116
PID 1292 wrote to memory of 5004	1292	chrome.exe	117
PID 1292 wrote to memory of 3692	1292	chrome.exe	118
PID 1292 wrote to memory of 3492	1292	chrome.exe	119
PID 1292 wrote to memory of 4684	1292	chrome.exe	120
PID 1292 wrote to memory of 1776	1292	chrome.exe	121
PID 1292 wrote to memory of 4928	1292	chrome.exe	123
PID 1292 wrote to memory of 820	1292	chrome.exe	124
PID 4252 wrote to memory of 3468	4252	4363463463464363463463463.exe	125
PID 4252 wrote to memory of 5076	4252	4363463463464363463463463.exe	140
PID 3468 wrote to memory of 4804	3468	wrm.exe	127
PID 4252 wrote to memory of 4188	4252	4363463463464363463463463.exe	128

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"
  2⤵
  - Executes dropped EXE
  PID:4564
- C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3648
- C:\Users\Admin\AppData\Local\Temp\Files\Complexo%20v4.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Complexo%20v4.exe"
  2⤵
  - Executes dropped EXE
  PID:3232
- C:\Users\Admin\AppData\Local\Temp\Files\IATInfect2008_64.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\IATInfect2008_64.exe"
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Users\Admin\AppData\Local\Temp\Files\finale.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\finale.exe"
  2⤵
  - Modifies Windows Defender DisableAntiSpyware settings
  - Windows security bypass
  - Executes dropped EXE
  - Windows security modification
  - Checks for any installed AV software in registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:452
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Set-MpPreference -DisableRealtimeMonitoring $true
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Disables one or more Microsoft Defender components
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Wcd3e5c96"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5000
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\winsetaccess64.exe"
  2⤵
  - Executes dropped EXE
  PID:5100
- C:\Users\Admin\AppData\Local\Temp\Files\UrbanVPN.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\UrbanVPN.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3372
- C:\Users\Admin\AppData\Local\Temp\Files\main.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Users\Admin\AppData\Local\Temp\Files\main.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\main.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1784
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4788
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:1292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffa3ae8c728,0x7ffa3ae8c734,0x7ffa3ae8c740
        5⤵
        
        PID:1048
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1660,i,8271767452387650964,13661328642226326507,262144 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
        5⤵
        
        PID:5004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=1548,i,2392846163151631593,4525924879243942813,524288 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2108 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3692
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2140,i,1351611562405038104,17174154257186175395,524288 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2224 /prefetch:8
        5⤵
        
        PID:3492
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2732,i,8904633963434842496,9250157512824634141,2097152 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2720 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:4684
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2876,i,12428893450504357241,4055473014796898979,2097152 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2892 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1776
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3964,i,5442304189833486201,14781388886687577266,2097152 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3988 /prefetch:2
        5⤵
        Uses browser remote debugging
        
        PID:4928
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=2828,i,10040339931354563545,116807278897449193,2097152 --field-trial-handle=1964,i,5022547549896898920,4967887816639301011,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4176 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:820
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4440
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:1840
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffa3ae8c728,0x7ffa3ae8c734,0x7ffa3ae8c740
        5⤵
        
        PID:1824
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:3660
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:1680
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffa40e4c728,0x7ffa40e4c734,0x7ffa40e4c740
        5⤵
        
        PID:1312
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1712,i,5829071869863040175,1453741654657228065,262144 --field-trial-handle=2456,i,2162695317812238103,8474984584156876595,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2452 /prefetch:2
        5⤵
        
        PID:1812
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1548,i,4699363021456255587,3274558017718742191,524288 --field-trial-handle=2456,i,2162695317812238103,8474984584156876595,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2460 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:4060
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1996,i,1798148149598438479,7632200920148558277,524288 --field-trial-handle=2456,i,2162695317812238103,8474984584156876595,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2476 /prefetch:8
        5⤵
        
        PID:1748
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /F /IM chrome.exe
      4⤵
      Kills process with taskkill
      PID:4804
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:/Program Files/Google/Chrome/Application/chrome.exe" --remote-debugging-port=9222 --profile-directory=Default --remote-allow-origins=* --window-position=10000,10000 --window-size=1,1 --disable-gpu --no-sandbox
      4⤵
      Uses browser remote debugging
      PID:3196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf4,0xf8,0xfc,0xd0,0x100,0x7ffa4091c728,0x7ffa4091c734,0x7ffa4091c740
        5⤵
        
        PID:1028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1692,i,6293387264623995290,11588493397131721130,262144 --field-trial-handle=2372,i,12125058469880349796,12464705817516218506,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
        5⤵
        
        PID:4400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,358132495990245713,8975030247676669928,524288 --field-trial-handle=2372,i,12125058469880349796,12464705817516218506,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --force-high-res-timeticks=disabled --metrics-shmem-handle=2068,i,3663511129029072045,10055164203543353130,524288 --field-trial-handle=2372,i,12125058469880349796,12464705817516218506,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
        5⤵
        
        PID:4652
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2892,i,5883462864638451549,11708180379034337367,2097152 --field-trial-handle=2372,i,12125058469880349796,12464705817516218506,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:3808
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,6231230135069900249,15315698873262401591,2097152 --field-trial-handle=2372,i,12125058469880349796,12464705817516218506,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:1
        5⤵
        Uses browser remote debugging
        
        PID:1776
- C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\x64-setup.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:1808
- C:\Users\Admin\AppData\Local\Temp\Files\plantrojan.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\plantrojan.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3120
- C:\Users\Admin\AppData\Local\Temp\Files\wrm.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\wrm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Files\wrm.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\wrm.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- C:\Users\Admin\AppData\Local\Temp\Files\file_b584670f7ec2f317.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file_b584670f7ec2f317.exe"
  2⤵
  - Executes dropped EXE
  PID:5076
- C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4188
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:892
- - C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
    3⤵
    PID:3852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1508
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3440
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:3644
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5076
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4644
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:2460
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:2360
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4180
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:1396
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:2332
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:2780
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:1472
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4432
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4852
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:464
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:1244
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4644
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:448
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4848
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:800
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4308
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4228
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1716
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:696
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:3980
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1168
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3308
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:2788
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4864
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:3856
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:3660
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4728
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:4788
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:4264
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1988
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:2152
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c "tasklist"
      4⤵
      Executes a command shell one-liner
      PID:1880
    - - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        5⤵
        Discovers running processes
        
        PID:316
- C:\Users\Admin\AppData\Local\Temp\Files\MIse.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\MIse.exe"
  2⤵
  PID:5052
- C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Local\Temp\Files\stlr.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stlr.exe"
  2⤵
  PID:1048
- - C:\Windows\helpPane.exe
    "C:\Windows\helpPane.exe"
    3⤵
    PID:312
- C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CryptoWall.exe"
  2⤵
  PID:4508
- - C:\Windows\SysWOW64\explorer.exe
    "C:\Windows\syswow64\explorer.exe"
    3⤵
    PID:4440
  - - C:\Windows\SysWOW64\svchost.exe
      -k netsvcs
      4⤵
      PID:4860
- C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ScreenConnect.ClientSetup.exe"
  2⤵
  PID:2612
- - C:\Windows\SysWOW64\msiexec.exe
    "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect\25.2.4.9229\cae7115510449f18\ScreenConnect.ClientSetup.msi"
    3⤵
    PID:652
- C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"
  2⤵
  PID:1200
- - C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe" /update "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe"
    3⤵
    PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe
      "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.exe" /delete "C:\Users\Admin\AppData\Local\Temp\Files\[UPG]CSS.new.exe"
      4⤵
      PID:4628

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2248

C:\3af90451\3af90451.exe
C:\3af90451\3af90451.exe
1⤵
PID:4040

C:\Users\Admin\AppData\Roaming\3af90451.exe
C:\Users\Admin\AppData\Roaming\3af90451.exe
1⤵
PID:3760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
PID:3084
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5767D3345D7710C47DCC2A93CEFD914A C
  2⤵
  PID:3904
- - C:\Windows\SysWOW64\rundll32.exe
    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\MSI3673.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240793250 1 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
    3⤵
    PID:2428

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4492

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Modify Authentication Process

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

Modify Authentication Process

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Modify Authentication Process