ghostsocks | 3f81758c69ee4a5e55575988d8a2d596ec994c4340d34071ce89981491447597

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Public\\Pictures\\UpdateAgent\\GraphicsService\\node_ipsec.exe"	node_ipsec.exe

Suspicious use of NtCreateProcessExOtherParentProcess 23 IoCs

description	pid	Process	procid_target
PID 4632 created 2712	4632	vi_db.exe	116
PID 4632 created 4760	4632	vi_db.exe	117
PID 4632 created 4356	4632	vi_db.exe	189
PID 4632 created 5344	4632	vi_db.exe	119
PID 4632 created 4196	4632	vi_db.exe	120
PID 4632 created 472	4632	vi_db.exe	122
PID 4632 created 2408	4632	vi_db.exe	123
PID 4632 created 2712	4632	vi_db.exe	116
PID 4632 created 2712	4632	vi_db.exe	116
PID 4632 created 4356	4632	vi_db.exe	189
PID 4632 created 4356	4632	vi_db.exe	189
PID 4632 created 2576	4632	vi_db.exe	165
PID 4632 created 4800	4632	vi_db.exe	166
PID 4632 created 1436	4632	vi_db.exe	168
PID 4632 created 4088	4632	vi_db.exe	169
PID 4632 created 1544	4632	vi_db.exe	170
PID 4632 created 5852	4632	vi_db.exe	172
PID 4632 created 4320	4632	vi_db.exe	173
PID 4632 created 4348	4632	vi_db.exe	174
PID 4632 created 2576	4632	vi_db.exe	165
PID 4632 created 2576	4632	vi_db.exe	165
PID 4632 created 1436	4632	vi_db.exe	168
PID 4632 created 1436	4632	vi_db.exe	168

Custom signature

Detects executables (downlaoders) containing URLs to raw contents of a paste 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ee-55.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL
behavioral2/files/0x000d00000001c4f1-57.dat	INDICATOR_SUSPICIOUS_EXE_RawPaste_URL

Custom signature

Detects executables referencing combination of virtualization drivers 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4ee-55.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb
behavioral2/files/0x000d00000001c4ef-64.dat	INDICATOR_SUSPICIOUS_VM_Evasion_VirtDrvComb

Enumerates VirtualBox registry keys 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	serveless.exe

Looks for VirtualBox drivers on disk 2 TTPs 8 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxSF.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxVideo.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxMouse.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\VBoxGuest.sys	SkyBridge.exe

Looks for VMWare Tools registry key 2 TTPs 2 IoCs

Query Registry

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools	serveless.exe

Looks for VMWare drivers on disk 2 TTPs 4 IoCs

File and Directory Discovery

T1083

Virtualization/Sandbox Evasion

description	ioc	Process
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	SkyBridge.exe
File opened (read-only)	C:\Windows\System32\drivers\vmmouse.sys	serveless.exe
File opened (read-only)	C:\Windows\System32\drivers\vmhgfs.sys	serveless.exe

Looks for VMWare services registry key. 1 TTPs 2 IoCs

Virtualization/Sandbox Evasion

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VMTools	serveless.exe

Modifies Windows Firewall 2 TTPs 6 IoCs

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1168	netsh.exe
5616	netsh.exe
4236	netsh.exe
4756	netsh.exe
2784	netsh.exe
1828	netsh.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe

Executes dropped EXE 23 IoCs

pid	Process
4600	DeltaNet.exe
3124	serveless.exe
5808	cloude_edge.exe
4632	vi_db.exe
5660	SkyBridge.exe
1652	node_ipsec.exe
1936	vsghssl.exe
3408	ntfs_au.exe
1172	cloude_edge.exe
2596	genodeb.exe
6140	ngrok-daemon.exe
3584	geminsync.exe
1524	serveless.exe
3340	GeminiService.exe
1132	ncat-daemon.exe
4648	OneSync.exe
1172	sqlite-host.exe
2524	osqueryd.exe
6092	VBoxVMM-service.exe
4356	firefox-service.exe
3180	chef-client-service.exe
6964	nginx-service.exe
2872	node_ipsec.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsSystemUpdate = "C:\\ProgramData\\nodes\\geminsync.exe"	cloude_edge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\DisplayManager = "C:\\Users\\Public\\Pictures\\GraphicsService\\DriverController\\serveless.exe"	serveless.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\DisplayHost = "C:\\Users\\Public\\Videos\\SystemModule\\AudioManager\\cloude_edge.exe"	cloude_edge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
127	pastebin.com
129	pastebin.com
7	pastebin.com
41	pastebin.com
117	pastebin.com
120	pastebin.com
1	pastebin.com
8	pastebin.com
43	pastebin.com
45	pastebin.com
47	pastebin.com

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	checkip.amazonaws.com

Checks system information in the registry 2 TTPs 3 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

persistence privilege_escalation

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	serveless.exe

Drops file in Program Files directory 16 IoCs

description	ioc	Process
File created	C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe	SkyBridge.exe
File created	C:\Program Files\Nginx\nginx-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File created	C:\Program Files\Google\Chrome\chrome-updater.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File opened for modification	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File created	C:\Program Files\Ansible\ansible-agent.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Nginx\nginx-service.exe	SkyBridge.exe
File created	C:\Program Files\Mozilla Firefox\firefox-service.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Chef\chef-client-service.exe	SkyBridge.exe
File created	C:\Program Files\Chef\chef-client-service.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File created	C:\Program Files\Nmap\ncat-daemon.exe	DeltaNet.exe
File created	C:\Program Files\osquery\osqueryd.exe	DeltaNet.exe
File opened for modification	C:\Program Files\Ansible\ansible-agent.exe	SkyBridge.exe
File opened for modification	C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe	SkyBridge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5324	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 18 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vsghssl.exe

System Time Discovery 1 TTPs 4 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4356	chrome.exe
1436	msedge.exe
4372	chrome.exe
4808	msedge.exe

Checks processor information in registry 2 TTPs 27 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ntfs_au.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	vi_db.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	vi_db.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ntfs_au.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	ntfs_au.exe
Key value enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	ntfs_au.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	ntfs_au.exe

Enumerates system info in registry 2 TTPs 20 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSerialNumber	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	SkyBridge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	serveless.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	SkyBridge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6044	ipconfig.exe
5408	ipconfig.exe
4792	ipconfig.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334868381581450"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{F0CD3D96-27D1-4056-BC1B-DFF26A02FC51}	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
5148	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4764	schtasks.exe
4172	schtasks.exe
3524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
3408	ntfs_au.exe
3408	ntfs_au.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
2712	chrome.exe
2712	chrome.exe
1652	node_ipsec.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
5660	SkyBridge.exe
3124	serveless.exe
5660	SkyBridge.exe
3124	serveless.exe
5660	SkyBridge.exe
5660	SkyBridge.exe
3124	serveless.exe
3124	serveless.exe
4632	vi_db.exe
4632	vi_db.exe
5324	powershell.exe
5324	powershell.exe
5324	powershell.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe
4632	vi_db.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
2712	chrome.exe
2712	chrome.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
3416	chrome.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe
4764	msedge.exe

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeDebugPrivilege	4632	vi_db.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeDebugPrivilege	5324	powershell.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	2712	chrome.exe
Token: SeCreatePagefilePrivilege	2712	chrome.exe
Token: SeShutdownPrivilege	3416	chrome.exe
Token: SeCreatePagefilePrivilege	3416	chrome.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2712	chrome.exe
2576	msedge.exe
3416	chrome.exe
4764	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3364 wrote to memory of 4792	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	89
PID 3364 wrote to memory of 5552	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	91
PID 3364 wrote to memory of 4600	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	95
PID 3364 wrote to memory of 3124	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	96
PID 3364 wrote to memory of 5808	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	97
PID 3364 wrote to memory of 4632	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	98
PID 3364 wrote to memory of 5660	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	99
PID 3364 wrote to memory of 1652	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	100
PID 1652 wrote to memory of 1168	1652	node_ipsec.exe	101
PID 3364 wrote to memory of 1936	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	103
PID 1652 wrote to memory of 5616	1652	node_ipsec.exe	104
PID 1652 wrote to memory of 4236	1652	node_ipsec.exe	106
PID 3364 wrote to memory of 3408	3364	2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe	108
PID 1652 wrote to memory of 4756	1652	node_ipsec.exe	109
PID 1652 wrote to memory of 2784	1652	node_ipsec.exe	111
PID 1652 wrote to memory of 1828	1652	node_ipsec.exe	114
PID 4632 wrote to memory of 2712	4632	vi_db.exe	116
PID 2712 wrote to memory of 4760	2712	chrome.exe	117
PID 2712 wrote to memory of 4356	2712	chrome.exe	189
PID 2712 wrote to memory of 5344	2712	chrome.exe	119
PID 2712 wrote to memory of 5344	2712	chrome.exe	119
PID 2712 wrote to memory of 4196	2712	chrome.exe	120
PID 2712 wrote to memory of 4196	2712	chrome.exe	120
PID 2712 wrote to memory of 472	2712	chrome.exe	122
PID 2712 wrote to memory of 472	2712	chrome.exe	122
PID 2712 wrote to memory of 2408	2712	chrome.exe	123
PID 2712 wrote to memory of 2408	2712	chrome.exe	123
PID 2712 wrote to memory of 5108	2712	chrome.exe	124
PID 2712 wrote to memory of 5108	2712	chrome.exe	124
PID 5660 wrote to memory of 5408	5660	SkyBridge.exe	125
PID 3124 wrote to memory of 6044	3124	serveless.exe	126
PID 5660 wrote to memory of 1948	5660	SkyBridge.exe	129
PID 3124 wrote to memory of 3360	3124	serveless.exe	130
PID 5808 wrote to memory of 3792	5808	cloude_edge.exe	133
PID 5808 wrote to memory of 4764	5808	cloude_edge.exe	193
PID 5808 wrote to memory of 1448	5808	cloude_edge.exe	140
PID 5808 wrote to memory of 4172	5808	cloude_edge.exe	144
PID 5808 wrote to memory of 5324	5808	cloude_edge.exe	150
PID 5808 wrote to memory of 1668	5808	cloude_edge.exe	206
PID 5808 wrote to memory of 3060	5808	cloude_edge.exe	157
PID 4632 wrote to memory of 2576	4632	vi_db.exe	165
PID 2576 wrote to memory of 4800	2576	msedge.exe	166
PID 2576 wrote to memory of 1436	2576	msedge.exe	168
PID 2576 wrote to memory of 4088	2576	msedge.exe	169
PID 2576 wrote to memory of 4088	2576	msedge.exe	169
PID 2576 wrote to memory of 4088	2576	msedge.exe	169
PID 2576 wrote to memory of 1544	2576	msedge.exe	170
PID 2576 wrote to memory of 1544	2576	msedge.exe	170
PID 2576 wrote to memory of 5852	2576	msedge.exe	172
PID 2576 wrote to memory of 4428	2576	msedge.exe	171
PID 2576 wrote to memory of 5852	2576	msedge.exe	172
PID 2576 wrote to memory of 5852	2576	msedge.exe	172
PID 2576 wrote to memory of 4428	2576	msedge.exe	171
PID 2576 wrote to memory of 4428	2576	msedge.exe	171
PID 2576 wrote to memory of 4320	2576	msedge.exe	173
PID 2576 wrote to memory of 4348	2576	msedge.exe	174
PID 2576 wrote to memory of 4320	2576	msedge.exe	173
PID 2576 wrote to memory of 4320	2576	msedge.exe	173
PID 2576 wrote to memory of 4348	2576	msedge.exe	174
PID 2576 wrote to memory of 4348	2576	msedge.exe	174
PID 2576 wrote to memory of 4292	2576	msedge.exe	175
PID 2576 wrote to memory of 4292	2576	msedge.exe	175
PID 2576 wrote to memory of 2812	2576	msedge.exe	178
PID 2576 wrote to memory of 2812	2576	msedge.exe	178

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_928d7eff7adc13c5085616e285939227_akira_cobalt-strike_glassworm_remcos_rusty-stealer_satacom.exe"
1⤵
- Checks BIOS information in registry
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3364
- C:\Windows\system32\ipconfig.exe
  "ipconfig"
  2⤵
  - Gathers network information
  PID:4792
- C:\Windows\system32\getmac.exe
  "getmac" /FO CSV /NH
  2⤵
  PID:5552
- C:\Users\Public\Documents\USBModule\WindowsComponent\DeltaNet.exe
  "C:\Users\Public\Documents\USBModule\WindowsComponent\DeltaNet.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:4600
- C:\Users\Public\Pictures\GraphicsService\DriverController\serveless.exe
  "C:\Users\Public\Pictures\GraphicsService\DriverController\serveless.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks system information in the registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:6044
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:3360
- C:\Users\Public\Videos\SystemModule\AudioManager\cloude_edge.exe
  "C:\Users\Public\Videos\SystemModule\AudioManager\cloude_edge.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:5808
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN OneDriveSyncHost
    3⤵
    PID:3792
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN OneDriveSyncHost /TR C:\ProgramData\gemini\genodeb.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4764
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN DiagnosticsCloudHost
    3⤵
    PID:1448
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /TN DiagnosticsCloudHost /TR C:\ProgramData\nodes\GeminiService.exe /F /RL HIGHEST /RU SYSTEM /SC ONSTART /DELAY 0001:00
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell" -NoProfile -Command "$WshShell = New-Object -comObject WScript.Shell; $Shortcut = $WshShell.CreateShortcut('C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\OneSync.lnk'); $Shortcut.TargetPath = 'C:\Users\Public\OneSync.exe'; $Shortcut.Save()"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5324
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN OneDriveSyncHost
    3⤵
    PID:1668
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Query /TN OneDriveSyncHost /FO LIST /V
    3⤵
    PID:3060
- C:\Users\Public\Documents\USBMonitor\DriverService\vi_db.exe
  "C:\Users\Public\Documents\USBMonitor\DriverService\vi_db.exe"
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffca722c728,0x7ffca722c734,0x7ffca722c740
      4⤵
      PID:4760
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1476,i,2373849148544657082,5999928560107297642,524288 --field-trial-handle=1904,i,1569450468174670800,14518475933758351381,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:11
      4⤵
      System Time Discovery
      PID:4356
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1624,i,5934801506396204414,5338993020013272895,262144 --field-trial-handle=1904,i,1569450468174670800,14518475933758351381,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
      4⤵
      PID:5344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,6407221687631450050,6603725020365675965,524288 --field-trial-handle=1904,i,1569450468174670800,14518475933758351381,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:13
      4⤵
      PID:4196
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3064,i,13830813732954709924,9807135425854151568,2097152 --field-trial-handle=1904,i,1569450468174670800,14518475933758351381,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,12369426091656338234,18159626733230475952,2097152 --field-trial-handle=1904,i,1569450468174670800,14518475933758351381,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:1
      4⤵
      PID:2408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,9472835968281661998,9994774864908652079,524288 --field-trial-handle=1904,i,1569450468174670800,14518475933758351381,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:14
      4⤵
      PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-gpu about:blank
    3⤵
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffca05bc188,0x7ffca05bc194,0x7ffca05bc1a0
      4⤵
      PID:4800
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,1801665341115417161,318984548886982644,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:11
      4⤵
      System Time Discovery
      PID:1436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1656,i,233668835694174108,6771339048760735651,262144 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
      4⤵
      PID:4088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,15152713221818769693,1005068532953537110,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:13
      4⤵
      PID:1544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,17273551922091859239,13272384614201925240,2097152 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
      4⤵
      PID:4428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8696661015452163468,15434217570713634221,2097152 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4084,i,3736472676008678696,15017276273950815141,2097152 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
      4⤵
      PID:4320
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4104,i,11396098661131961698,2044194878997130578,2097152 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:9
      4⤵
      PID:4348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,11323387168667744304,12679350804777912260,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
      4⤵
      PID:4292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,4785264114698452869,3189371118359104324,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:14
      4⤵
      PID:2812
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7744651846695010981,10268402676731426783,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
      4⤵
      PID:2648
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15281096372294909381,15576262480068920435,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:3964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,15281096372294909381,15576262480068920435,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
      4⤵
      PID:432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,11917280214846736782,10235317668918181020,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
      4⤵
      PID:3416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,14890143858710232191,2839893925815648981,524288 --field-trial-handle=2296,i,2347689082461467275,16021802242986274240,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:14
      4⤵
      PID:2672
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" about:blank
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:3416
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\sncTsk\d05fb562 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\sncTsk\d05fb562\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\sncTsk\d05fb562 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x128,0x138,0x7ffcb22fc728,0x7ffcb22fc734,0x7ffcb22fc740
      4⤵
      PID:824
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2204 /prefetch:2
      4⤵
      PID:3396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --no-pre-read-main-dll --force-high-res-timeticks=disabled --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3008 /prefetch:11
      4⤵
      System Time Discovery
      PID:4372
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --force-high-res-timeticks=disabled --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3032 /prefetch:13
      4⤵
      PID:2072
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3080 /prefetch:1
      4⤵
      PID:4296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3060 /prefetch:1
      4⤵
      PID:5976
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3728 /prefetch:9
      4⤵
      PID:2348
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3704 /prefetch:1
      4⤵
      PID:1408
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\d05fb562" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=2772,i,18087012829514386095,12236789761554045017,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4448 /prefetch:9
      4⤵
      PID:1136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" about:blank
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\sncTsk\2f439673 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\sncTsk\2f439673\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x25c,0x260,0x264,0x258,0x2c4,0x7ffca70cc188,0x7ffca70cc194,0x7ffca70cc1a0
      4⤵
      PID:556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --headless --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2564 /prefetch:2
      4⤵
      PID:1668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2624 /prefetch:11
      4⤵
      System Time Discovery
      PID:4808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --force-high-res-timeticks=disabled --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=2756 /prefetch:13
      4⤵
      PID:3180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3532 /prefetch:1
      4⤵
      PID:3688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3564 /prefetch:1
      4⤵
      PID:3136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4124 /prefetch:9
      4⤵
      PID:5080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4248 /prefetch:1
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4176 /prefetch:1
      4⤵
      PID:748
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4120 /prefetch:9
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4180 /prefetch:9
      4⤵
      PID:712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4664 /prefetch:1
      4⤵
      PID:2744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4668 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4684 /prefetch:9
      4⤵
      PID:3340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\2f439673" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --field-trial-handle=2568,i,9044997156103388435,10532075580762077432,262144 --disable-features=PaintHolding --variations-seed-version --disable-logging --log-level=3 --mojo-platform-channel-handle=4276 /prefetch:9
      4⤵
      PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir="C:\Users\Admin\AppData\Local\sncTsk\c35246ae" about:blank
    3⤵
    PID:5916
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-first-run --disable-extensions --headless --disable-logging --log-level=3 --user-data-dir=C:\Users\Admin\AppData\Local\sncTsk\c35246ae about:blank
      4⤵
      Checks processor information in registry
      PID:4432
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\sncTsk\c35246ae"
    3⤵
    PID:6412
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\sncTsk\d05fb562"
    3⤵
    PID:6172
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /c rmdir /s /q "C:\Users\Admin\AppData\Local\sncTsk\2f439673"
    3⤵
    PID:6164
- C:\Users\Public\Videos\WindowsService\SecurityHost\SkyBridge.exe
  "C:\Users\Public\Videos\WindowsService\SecurityHost\SkyBridge.exe"
  2⤵
  - Enumerates VirtualBox registry keys
  - Looks for VirtualBox drivers on disk
  - Looks for VMWare Tools registry key
  - Looks for VMWare drivers on disk
  - Looks for VMWare services registry key.
  - Executes dropped EXE
  - Checks system information in the registry
  - Drops file in Program Files directory
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5660
- - C:\Windows\system32\ipconfig.exe
    "ipconfig"
    3⤵
    - Gathers network information
    PID:5408
- - C:\Windows\system32\getmac.exe
    "getmac" /FO CSV /NH
    3⤵
    PID:1948
- C:\Users\Public\Pictures\UpdateAgent\GraphicsService\node_ipsec.exe
  "C:\Users\Public\Pictures\UpdateAgent\GraphicsService\node_ipsec.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1652
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57001 dir=in action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1168
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57001 dir=out action=allow protocol=TCP localport=57001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:5616
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_57002 dir=in action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4236
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_57002 dir=out action=allow protocol=TCP localport=57002
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:4756
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_In_56001 dir=in action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:2784
- - C:\Windows\system32\netsh.exe
    "netsh" advfirewall firewall add rule name=Telemetry_Out_56001 dir=out action=allow protocol=TCP localport=56001
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    PID:1828
- - C:\Windows\system32\schtasks.exe
    "schtasks" /Create /F /SC ONLOGON /TN DataPruneJob /TR C:\Users\Public\Pictures\UpdateAgent\GraphicsService\node_ipsec.exe /RL HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3524
- - C:\Windows\system32\reg.exe
    "reg.exe" ADD HKLM\Software\Microsoft\Windows\CurrentVersion\Run /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5148
- C:\Users\Public\Videos\NetworkModule\ServiceProcess\vsghssl.exe
  "C:\Users\Public\Videos\NetworkModule\ServiceProcess\vsghssl.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1936
- C:\Users\Public\Documents\MonitorProcess\GraphicsAgent\ntfs_au.exe
  "C:\Users\Public\Documents\MonitorProcess\GraphicsAgent\ntfs_au.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3408

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2508

C:\Users\Public\Videos\SystemModule\AudioManager\cloude_edge.exe
C:\Users\Public\Videos\SystemModule\AudioManager\cloude_edge.exe
1⤵
- Executes dropped EXE
PID:1172

C:\ProgramData\gemini\genodeb.exe
C:\ProgramData\gemini\genodeb.exe
1⤵
- Executes dropped EXE
PID:2596

C:\Users\Public\ngrok\ngrok-daemon.exe
C:\Users\Public\ngrok\ngrok-daemon.exe
1⤵
- Executes dropped EXE
PID:6140

C:\ProgramData\nodes\geminsync.exe
C:\ProgramData\nodes\geminsync.exe
1⤵
- Executes dropped EXE
PID:3584

C:\Users\Public\Pictures\GraphicsService\DriverController\serveless.exe
C:\Users\Public\Pictures\GraphicsService\DriverController\serveless.exe
1⤵
- Executes dropped EXE
PID:1524

C:\ProgramData\nodes\GeminiService.exe
C:\ProgramData\nodes\GeminiService.exe
1⤵
- Executes dropped EXE
PID:3340

C:\Users\Public\OneSync.exe
C:\Users\Public\OneSync.exe
1⤵
- Executes dropped EXE
PID:4648

C:\Program Files\Nmap\ncat-daemon.exe
"C:\Program Files\Nmap\ncat-daemon.exe"
1⤵
- Executes dropped EXE
PID:1132

C:\Users\Public\SQLite\sqlite-host.exe
C:\Users\Public\SQLite\sqlite-host.exe
1⤵
- Executes dropped EXE
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1508

C:\Program Files\osquery\osqueryd.exe
"C:\Program Files\osquery\osqueryd.exe"
1⤵
- Executes dropped EXE
PID:2524

C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe
"C:\Program Files\Oracle\VirtualBox\VBoxVMM-service.exe"
1⤵
- Executes dropped EXE
PID:6092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3212

C:\PROGRA~1\MOZILL~1\firefox-service.exe
C:\PROGRA~1\MOZILL~1\FIREFO~1.EXE
1⤵
- Executes dropped EXE
PID:4356

C:\Program Files\Chef\chef-client-service.exe
"C:\Program Files\Chef\chef-client-service.exe"
1⤵
- Executes dropped EXE
PID:3180

C:\PROGRA~1\Nginx\nginx-service.exe
C:\PROGRA~1\Nginx\NGINX-~1.EXE
1⤵
- Executes dropped EXE
PID:6964

C:\Users\Public\Pictures\UpdateAgent\GraphicsService\node_ipsec.exe
C:\Users\Public\Pictures\UpdateAgent\GraphicsService\node_ipsec.exe
1⤵
- Executes dropped EXE
PID:2872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Virtualization/Sandbox Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Browser Information Discovery

T1217

File and Directory Discovery

T1083

Query Registry

System Information Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Virtualization/Sandbox Evasion