hxxps://www[.]mediafire[.]com/file/xltgz1n2cdp93co/YUNA-Setup-1[.]12[.]exe/file

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Ollama.lnk	ollama app.exe

Executes dropped EXE 31 IoCs

pid	Process
3664	YUNA-Setup-1.12.exe
2392	YUNA-Setup-1.12.tmp
1128	python-3.10.11-yuna.exe
5908	python-3.10.11-yuna.exe
5336	uv.exe
3208	YUNA.exe
4936	python-3.10.11-amd64.exe
4636	python-3.10.11-amd64.exe
4676	python-3.10.11-amd64.exe
1240	YUNA.exe
3176	python.exe
2980	python.exe
11116	OllamaSetup.exe
11160	OllamaSetup.tmp
4408	ollama app.exe
4556	ollama.exe
9032	llama-server.exe
6904	llama-server.exe
2440	ollama.exe
4772	llama-server.exe
876	llama-server.exe
8728	llama-server.exe
9420	llama-server.exe
9052	llama-server.exe
10512	llama-server.exe
10252	ollama.exe
7224	YUNA.exe
8576	YUNA.exe
10036	ollama.EXE
12052	YUNA.exe
5044	YUNA.exe

Loads dropped DLL 64 IoCs

pid	Process
5908	python-3.10.11-yuna.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
4676	python-3.10.11-amd64.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
6132	MsiExec.exe
3176	python.exe
3176	python.exe
3176	python.exe
3176	python.exe
3176	python.exe
3176	python.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{a10fbb63-03ff-4b8c-a176-f5fd355f715b} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\\python-3.10.11-amd64.exe\" /burn.runonce"	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{a10fbb63-03ff-4b8c-a176-f5fd355f715b} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\\python-3.10.11-amd64.exe\" /burn.runonce"	python-3.10.11-amd64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ollama app.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
6004	tasklist.exe
1600	tasklist.exe

Hide Artifacts: Hidden Files and Directories 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3916	cmd.exe
4892	cmd.exe
376	cmd.exe
7148	cmd.exe
7568	cmd.exe

Drops file in Program Files directory 11 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1462152208\deny_etld1_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_2132039467\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_2132039467\typosquatting_list.pb	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_1371527747\LICENSE	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_1371527747\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_1371527747\_platform_specific\win_x64\widevinecdm.dll	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_1371527747\_platform_specific\win_x64\widevinecdm.dll.sig	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1462152208\deny_full_domains.list	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1462152208\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping10168_1371527747\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4484_1462152208\deny_domains.list	msedge.exe

Drops file in Windows directory 51 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIB712.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb09f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e5bb0a8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF5A9.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6DBAD419-6A71-4996-912C-E783E21B46AA}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF982.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb0b1.msi	msiexec.exe
File created	C:\Windows\Installer\e5bb0ca.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F8AA714D-9073-4CC3-AD61-743E85488839}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8D87865C-0573-40CE-BC1A-A9C1473120C3}	msiexec.exe
File created	C:\Windows\Installer\e5bb0ba.msi	msiexec.exe
File created	C:\Windows\Installer\e5bb0be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53FC.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb0c6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA9F1.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}	msiexec.exe
File created	C:\Windows\Installer\e5bb0a3.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6532871D-1F76-408C-ABD0-63C732137351}	msiexec.exe
File created	C:\Windows\Installer\e5bb0b6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3D54.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4555.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5C3F818F-9EF5-444C-9386-77A0063A383A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb09f.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF0B6.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{7D83DF0A-088D-4738-8012-7122B67B294C}	msiexec.exe
File created	C:\Windows\Installer\e5bb0c2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI85EB.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb0ce.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI884E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0be.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB55C.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC07E.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb0b0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0b6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0c6.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6108D417-E511-4AFC-A24D-7CEE1DC9D3EE}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI87D0.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb0d2.msi	msiexec.exe
File created	C:\Windows\Installer\e5bb0a4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5EAB.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0a4.msi	msiexec.exe
File created	C:\Windows\Installer\e5bb0ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5bb0b1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1067.tmp	msiexec.exe
File created	C:\Windows\Installer\e5bb0b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4275.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2956	powershell.exe

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x0007000000024820-1001.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
9404	cmd.exe
5268	cmd.exe
5552	cmd.exe
5032	cmd.exe
9412	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YUNA-Setup-1.12.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YUNA-Setup-1.12.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.10.11-yuna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.10.11-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.10.11-amd64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OllamaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OllamaSetup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.10.11-yuna.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	python-3.10.11-amd64.exe

System Network Connections Discovery 1 TTPs 2 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

pid	Process
11928	netstat.exe
8144	netstat.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
6036	chrome.exe
6416	msedge.exe
8024	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 6 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/3664-357-0x00000000006D0000-0x00000000007AC000-memory.dmp	innosetup
behavioral1/memory/3664-378-0x00000000006D0000-0x00000000007AC000-memory.dmp	innosetup
behavioral1/memory/3664-2251-0x00000000006D0000-0x00000000007AC000-memory.dmp	innosetup
behavioral1/memory/11116-12862-0x0000000000E10000-0x0000000000EED000-memory.dmp	innosetup
behavioral1/memory/11116-13164-0x0000000000E10000-0x0000000000EED000-memory.dmp	innosetup
behavioral1/memory/11116-15160-0x0000000000E10000-0x0000000000EED000-memory.dmp	innosetup

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	YUNA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	YUNA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	YUNA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	YUNA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	YUNA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	YUNA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	YUNA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	YUNA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	YUNA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	YUNA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	YUNA.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	YUNA.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	llama-server.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	llama-server.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
11928	netstat.exe
8144	netstat.exe

Kills process with taskkill 4 IoCs

defense_evasion

pid	Process
9576	taskkill.exe
9692	taskkill.exe
2200	taskkill.exe
11224	taskkill.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134340726551851145"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6108D417-E511-4AFC-A24D-7CEE1DC9D3EE}\DisplayName = "Python 3.10.11 Tcl/Tk Support (64-bit)"	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.NoConFile	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{5C3F818F-9EF5-444C-9386-77A0063A383A}\ = "{5C3F818F-9EF5-444C-9386-77A0063A383A}"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\ = "{F8AA714D-9073-4CC3-AD61-743E85488839}"	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6532871D-1F76-408C-ABD0-63C732137351}	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.File\Shell\editwithidle\shell\edit310	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.File\Shell\editwithidle\shell\edit310\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\YUNA\\runtime\\python310\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.NoConFile\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6108D417-E511-4AFC-A24D-7CEE1DC9D3EE}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{5C3F818F-9EF5-444C-9386-77A0063A383A}\DisplayName = "Python 3.10.11 pip Bootstrap (64-bit)"	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{7D83DF0A-088D-4738-8012-7122B67B294C}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{5C3F818F-9EF5-444C-9386-77A0063A383A}\DisplayName = "Python 3.10.11 pip Bootstrap (64-bit)"	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{7D83DF0A-088D-4738-8012-7122B67B294C}	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}\Version = "3.10.11150.0"	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}\DisplayName = "Python 3.10.11 Development Libraries (64-bit)"	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{8D87865C-0573-40CE-BC1A-A9C1473120C3}\ = "{8D87865C-0573-40CE-BC1A-A9C1473120C3}"	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}\DisplayName = "Python 3.10.11 Development Libraries (64-bit)"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6532871D-1F76-408C-ABD0-63C732137351}\ = "{6532871D-1F76-408C-ABD0-63C732137351}"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{7D83DF0A-088D-4738-8012-7122B67B294C}\ = "{7D83DF0A-088D-4738-8012-7122B67B294C}"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{7D83DF0A-088D-4738-8012-7122B67B294C}\DisplayName = "Python 3.10.11 Utility Scripts (64-bit)"	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ollama	OllamaSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\Dependents	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{5C3F818F-9EF5-444C-9386-77A0063A383A}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}\ = "{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\ = "{F8AA714D-9073-4CC3-AD61-743E85488839}"	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{8D87865C-0573-40CE-BC1A-A9C1473120C3}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.File\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\CPython-3.10\Version = "3.10.11150.0"	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}\ = "{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}"	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{5C3F818F-9EF5-444C-9386-77A0063A383A}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.NoConFile\Shell\editwithidle\shell\edit310\MUIVerb = "Edit with IDLE 3.10 (64-bit)"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6108D417-E511-4AFC-A24D-7CEE1DC9D3EE}	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\CPython-3.10\ = "{a10fbb63-03ff-4b8c-a176-f5fd355f715b}"	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{8D87865C-0573-40CE-BC1A-A9C1473120C3}\Dependents	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.NoConFile\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{7D83DF0A-088D-4738-8012-7122B67B294C}\Version = "3.10.11150.0"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{8D87865C-0573-40CE-BC1A-A9C1473120C3}\DisplayName = "Python 3.10.11 Documentation (64-bit)"	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.NoConFile\Shell\editwithidle	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{4ABF45B3-95C6-4978-B2DF-416A70E2325E}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ollama\ = "URL:Ollama Protocol"	OllamaSetup.tmp
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\ollama\shell\open	OllamaSetup.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\Version = "3.10.11150.0"	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{F8AA714D-9073-4CC3-AD61-743E85488839}\Version = "3.10.11150.0"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}\Version = "3.10.11150.0"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6532871D-1F76-408C-ABD0-63C732137351}\ = "{6532871D-1F76-408C-ABD0-63C732137351}"	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6532871D-1F76-408C-ABD0-63C732137351}\DisplayName = "Python 3.10.11 Standard Library (64-bit)"	python-3.10.11-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6108D417-E511-4AFC-A24D-7CEE1DC9D3EE}\ = "{6108D417-E511-4AFC-A24D-7CEE1DC9D3EE}"	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{8D87865C-0573-40CE-BC1A-A9C1473120C3}	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\CPython-3.10	python-3.10.11-yuna.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}\ = "{6DBAD419-6A71-4996-912C-E783E21B46AA}"	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer	python-3.10.11-yuna.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{D59C7C1D-92A7-4836-B90F-2F50BE301EE1}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{6DBAD419-6A71-4996-912C-E783E21B46AA}\Dependents\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}	python-3.10.11-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Python.File\Shell\editwithidle\shell\edit310\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000_Classes\Installer\Dependencies\{5C3F818F-9EF5-444C-9386-77A0063A383A}\Version = "3.10.11150.0"	python-3.10.11-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
10072	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 63 IoCs

pid	Process
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
4304	chrome.exe
4304	chrome.exe
2392	YUNA-Setup-1.12.tmp
2392	YUNA-Setup-1.12.tmp
2956	powershell.exe
2956	powershell.exe
2956	powershell.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
3924	msiexec.exe
10576	msedge.exe
10576	msedge.exe
10168	msedge.exe
10168	msedge.exe
4556	ollama.exe
4556	ollama.exe
4556	ollama.exe
4556	ollama.exe
2440	ollama.exe
2440	ollama.exe
2440	ollama.exe
2440	ollama.exe
10252	ollama.exe
10252	ollama.exe
10252	ollama.exe
10252	ollama.exe
10036	ollama.EXE
10036	ollama.EXE
10036	ollama.EXE
10036	ollama.EXE
7504	msedge.exe
7504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs

pid	Process
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
1932	msedgewebview2.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe
Token: SeShutdownPrivilege	5216	chrome.exe
Token: SeCreatePagefilePrivilege	5216	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
5216	chrome.exe
4408	ollama app.exe
4408	ollama app.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
1240	YUNA.exe
1240	YUNA.exe
1240	YUNA.exe
8576	YUNA.exe
8576	YUNA.exe
5044	YUNA.exe
5044	YUNA.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 912	5216	chrome.exe	86
PID 5216 wrote to memory of 3444	5216	chrome.exe	87
PID 5216 wrote to memory of 3444	5216	chrome.exe	87
PID 5216 wrote to memory of 6036	5216	chrome.exe	88
PID 5216 wrote to memory of 4456	5216	chrome.exe	89
PID 5216 wrote to memory of 4456	5216	chrome.exe	89
PID 5216 wrote to memory of 3712	5216	chrome.exe	91
PID 5216 wrote to memory of 3212	5216	chrome.exe	92
PID 5216 wrote to memory of 3712	5216	chrome.exe	91
PID 5216 wrote to memory of 3212	5216	chrome.exe	92
PID 5216 wrote to memory of 2316	5216	chrome.exe	93
PID 5216 wrote to memory of 2316	5216	chrome.exe	93
PID 5216 wrote to memory of 5192	5216	chrome.exe	95
PID 5216 wrote to memory of 5192	5216	chrome.exe	95
PID 5216 wrote to memory of 6116	5216	chrome.exe	96
PID 5216 wrote to memory of 6116	5216	chrome.exe	96
PID 5216 wrote to memory of 2396	5216	chrome.exe	97
PID 5216 wrote to memory of 2396	5216	chrome.exe	97
PID 5216 wrote to memory of 5608	5216	chrome.exe	99
PID 5216 wrote to memory of 5608	5216	chrome.exe	99
PID 5216 wrote to memory of 2032	5216	chrome.exe	100
PID 5216 wrote to memory of 2032	5216	chrome.exe	100
PID 5216 wrote to memory of 2524	5216	chrome.exe	101
PID 5216 wrote to memory of 2524	5216	chrome.exe	101
PID 5216 wrote to memory of 4780	5216	chrome.exe	102
PID 5216 wrote to memory of 4780	5216	chrome.exe	102
PID 5216 wrote to memory of 1072	5216	chrome.exe	103
PID 5216 wrote to memory of 1072	5216	chrome.exe	103
PID 5216 wrote to memory of 2800	5216	chrome.exe	104
PID 5216 wrote to memory of 2800	5216	chrome.exe	104
PID 5216 wrote to memory of 5712	5216	chrome.exe	105
PID 5216 wrote to memory of 5712	5216	chrome.exe	105
PID 5216 wrote to memory of 4776	5216	chrome.exe	106
PID 5216 wrote to memory of 4776	5216	chrome.exe	106
PID 5216 wrote to memory of 1696	5216	chrome.exe	107
PID 5216 wrote to memory of 1696	5216	chrome.exe	107
PID 5216 wrote to memory of 3592	5216	chrome.exe	108
PID 5216 wrote to memory of 1528	5216	chrome.exe	111
PID 5216 wrote to memory of 5020	5216	chrome.exe	112
PID 5216 wrote to memory of 4668	5216	chrome.exe	113
PID 5216 wrote to memory of 5932	5216	chrome.exe	116
PID 5216 wrote to memory of 3664	5216	chrome.exe	117
PID 3664 wrote to memory of 2392	3664	YUNA-Setup-1.12.exe	119
PID 5216 wrote to memory of 4304	5216	chrome.exe	121
PID 5216 wrote to memory of 5924	5216	chrome.exe	122
PID 5216 wrote to memory of 5924	5216	chrome.exe	122
PID 2392 wrote to memory of 2956	2392	YUNA-Setup-1.12.tmp	123
PID 2956 wrote to memory of 5540	2956	powershell.exe	127
PID 2956 wrote to memory of 1128	2956	powershell.exe	128
PID 1128 wrote to memory of 5908	1128	python-3.10.11-yuna.exe	129
PID 2956 wrote to memory of 5336	2956	powershell.exe	130
PID 2392 wrote to memory of 3208	2392	YUNA-Setup-1.12.tmp	136
PID 4936 wrote to memory of 4636	4936	python-3.10.11-amd64.exe	138
PID 4636 wrote to memory of 4676	4636	python-3.10.11-amd64.exe	139
PID 3208 wrote to memory of 1240	3208	YUNA.exe	140
PID 1240 wrote to memory of 5268	1240	YUNA.exe	141
PID 1240 wrote to memory of 6004	1240	YUNA.exe	144
PID 1240 wrote to memory of 1600	1240	YUNA.exe	147
PID 3924 wrote to memory of 6132	3924	msiexec.exe	152
PID 6132 wrote to memory of 3176	6132	MsiExec.exe	153
PID 3176 wrote to memory of 2980	3176	python.exe	155
PID 2980 wrote to memory of 5552	2980	python.exe	156
PID 1240 wrote to memory of 3916	1240	YUNA.exe	159
PID 3916 wrote to memory of 1380	3916	cmd.exe	161

Views/modifies file attributes 1 TTPs 5 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
1380	attrib.exe
4700	attrib.exe
220	attrib.exe
10004	attrib.exe
11064	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/xltgz1n2cdp93co/YUNA-Setup-1.12.exe/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff928e7c728,0x7ff928e7c734,0x7ff928e7c740
  2⤵
  PID:912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1680,i,10263835587433943225,6940665814758139366,262144 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2000 /prefetch:2
  2⤵
  PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,15557082838827568037,10884261862157853109,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:6036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,17191386334596751905,3384553629961912653,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,5345568766064092465,16592720338204059765,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,6301829323468839332,1262036043745914292,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4412,i,13206954687840209471,16704334545532575416,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:2316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4960,i,6151367738190475144,9538361289179176350,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:5192
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4924,i,14718481438996112962,7130867671573386591,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:6116
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5096,i,9785662644408691817,6020229170527626912,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5428,i,9608844794617207992,2090759736128796055,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:5608
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5580,i,6462026252299836334,2455071573191988266,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5960,i,11727317898014481818,15110094564126027878,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=6132,i,8488166830390198445,17257215219332267064,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6280,i,4652605920421623603,8164808241314056325,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6424,i,3190828083317604954,2763732253166832800,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6568,i,5514764802933523786,17445506544379589107,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6736,i,13618068141148511177,15905182227104090100,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=7572,i,8512208371635901747,2856643319247731211,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7632 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=304,i,7410524895890286426,8090265366320007345,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7852 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4960,i,7067867341637167900,4603852435997111338,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4920,i,11991199401195879165,16185583969682545921,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4876,i,2308731453319189490,15203519566319221197,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6772,i,15903664554111995166,15379384848815821912,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:5932
- C:\Users\Admin\Downloads\YUNA-Setup-1.12.exe
  "C:\Users\Admin\Downloads\YUNA-Setup-1.12.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3664
- - C:\Users\Admin\AppData\Local\Temp\is-5PJAH6TCHH.tmp\YUNA-Setup-1.12.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-5PJAH6TCHH.tmp\YUNA-Setup-1.12.tmp" /SL5="$501E6,1094976760,842240,C:\Users\Admin\Downloads\YUNA-Setup-1.12.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2392
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -ExecutionPolicy Bypass -NoProfile -File "C:\Users\Admin\AppData\Local\Programs\YUNA\install_yuna.ps1" -InstallDir "C:\Users\Admin\AppData\Local\Programs\YUNA"
      4⤵
      Badlisted process makes network request
      Downloads MZ/PE file
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2956
    - - C:\Windows\system32\where.exe
        
        "C:\Windows\system32\where.exe" py
        5⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\python-3.10.11-yuna.exe
        
        "C:\Users\Admin\AppData\Local\Temp\python-3.10.11-yuna.exe" /quiet TargetDir=C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310 InstallAllUsers=0 PrependPath=0 Include_test=0 Include_launcher=0
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:1128
      - C:\Windows\Temp\{4D6E0482-F7D3-4A69-8D6C-7B2DD33DCF77}\.cr\python-3.10.11-yuna.exe
        
        "C:\Windows\Temp\{4D6E0482-F7D3-4A69-8D6C-7B2DD33DCF77}\.cr\python-3.10.11-yuna.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\python-3.10.11-yuna.exe" -burn.filehandle.attached=544 -burn.filehandle.self=552 /quiet TargetDir=C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310 InstallAllUsers=0 PrependPath=0 Include_test=0 Include_launcher=0
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Adds Run key to start application
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5908
    - - C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\uv.exe
        
        "C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\uv.exe" python install 3.10
        5⤵
        Executes dropped EXE
        
        PID:5336
  - - C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe
      "C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3208
    - - C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe
        
        "C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks SCSI registry key(s)
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1240
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        6⤵
        Executes a command shell one-liner
        
        PID:5268
      - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /fo csv /nh
        6⤵
        Discovers running processes
        
        PID:6004
      - C:\Windows\SYSTEM32\tasklist.exe
        
        tasklist /fo csv /nh
        6⤵
        Discovers running processes
        
        PID:1600
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\.yuna_auth"
        6⤵
        Hide Artifacts: Hidden Files and Directories
        Suspicious use of WriteProcessMemory
        
        PID:3916
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\.yuna_auth
        7⤵
        Views/modifies file attributes
        
        PID:1380
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\.~yuna_cache"
        6⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:4892
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Local\Temp\.~yuna_cache
        7⤵
        Views/modifies file attributes
        
        PID:4700
      - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI00000c882\.yuna_state"
        6⤵
        Hide Artifacts: Hidden Files and Directories
        
        PID:376
        
        C:\Windows\system32\attrib.exe
        
        attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI00000c882\.yuna_state
        7⤵
        Views/modifies file attributes
        
        PID:220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ollama.com/download
        6⤵
        
        PID:1332
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://ollama.com/download
        7⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:4484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x240,0x7ff905c0c188,0x7ff905c0c194,0x7ff905c0c1a0
        8⤵
        
        PID:6508
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1904,i,17198901244136536500,9175510334135637346,262144 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
        8⤵
        
        PID:2544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,1309324853293883254,4070195417482141526,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
        8⤵
        Downloads MZ/PE file
        System Time Discovery
        
        PID:6416
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,9242768937810672013,10749541600868364229,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
        8⤵
        
        PID:3276
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,506497250918319000,14740172710959509664,2097152 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        8⤵
        
        PID:8504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,5777992492673450109,9258060986583242235,2097152 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
        8⤵
        
        PID:5368
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,10321842761501156666,1355541616473009502,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
        8⤵
        
        PID:8984
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,15138909613449242849,16612268059247347873,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
        8⤵
        
        PID:8324
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16883891914562498133,16999644716662981110,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
        8⤵
        
        PID:9124
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,16883891914562498133,16999644716662981110,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
        8⤵
        
        PID:6784
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,3141882068313662709,8474236554605122572,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
        8⤵
        
        PID:7064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6388,i,1944521242545995410,2245168804714974894,2097152 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
        8⤵
        
        PID:7272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,15994840885604411040,5079094964309756862,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
        8⤵
        
        PID:6844
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,7639688781396902047,13361676795317224694,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
        8⤵
        
        PID:6856
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,8660178560662349790,1342579503370905902,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
        8⤵
        
        PID:3480
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,1836183172020705751,1088307275876413300,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
        8⤵
        
        PID:6992
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,14607415991385824966,16713214461245321838,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
        8⤵
        
        PID:7484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5616,i,8063541540882982636,10166619612060846880,262144 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:8
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:10576
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,14016064989426052299,16261795120682351556,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
        8⤵
        
        PID:10744
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=556,i,5518953739177926482,2571026886413352721,524288 --field-trial-handle=1976,i,11136531317032713437,10629265023776347041,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:8
        8⤵
        
        PID:10852
        
        C:\Users\Admin\Downloads\OllamaSetup.exe
        
        "C:\Users\Admin\Downloads\OllamaSetup.exe"
        8⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\is-IU2AE09029.tmp\OllamaSetup.tmp
        
        "C:\Users\Admin\AppData\Local\Temp\is-IU2AE09029.tmp\OllamaSetup.tmp" /SL5="$40372,1569250677,845824,C:\Users\Admin\Downloads\OllamaSetup.exe"
        9⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:11160
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill.exe" /f /t /im "ollama app.exe"
        10⤵
        Kills process with taskkill
        
        PID:11224
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill.exe" /f /t /im "llama-server.exe"
        10⤵
        Kills process with taskkill
        
        PID:9576
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill.exe" /f /t /im "ollama.exe"
        10⤵
        Kills process with taskkill
        
        PID:9692
        
        C:\Windows\system32\taskkill.exe
        
        "taskkill.exe" /f /t /im "llama-server.exe"
        10⤵
        Kills process with taskkill
        
        PID:2200
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /C set PATH=C:\Users\Admin\AppData\Local\Programs\Ollama;%PATH% & "C:\Users\Admin\AppData\Local\Programs\Ollama\ollama app.exe"
        10⤵
        Executes a command shell one-liner
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama app.exe
        
        "C:\Users\Admin\AppData\Local\Programs\Ollama\ollama app.exe"
        11⤵
        Creates a file in the Startup directory
        Executes dropped EXE
        Checks whether UAC is enabled
        Suspicious use of SendNotifyMessage
        
        PID:4408
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="ollama app.exe" --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --mojo-named-platform-channel-pipe=4408.516.18314537553979319829
        12⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:1932
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff904aeb078,0x7ff904aeb084,0x7ff904aeb090
        13⤵
        
        PID:432
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1728,i,344293371348775742,17690911766237940013,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
        13⤵
        
        PID:9084
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2036,i,344293371348775742,17690911766237940013,262144 --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:3
        13⤵
        
        PID:6932
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2416,i,344293371348775742,17690911766237940013,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:8
        13⤵
        
        PID:6104
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Roaming\ollama app.exe\EBWebView" --webview-exe-name="ollama app.exe" --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3648,i,344293371348775742,17690911766237940013,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
        13⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe serve
        12⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:4556
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 62922 --host 127.0.0.1 --no-webui --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe gpu-discover --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\cuda_v12
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:2440
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 58676 --host 127.0.0.1 --no-webui --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 52730 --host 127.0.0.1 --no-webui --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --port 55717 --host 127.0.0.1 --no-webui --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\llama-server.exe --list-devices --offline --verbose
        13⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe
        
        C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.exe gpu-discover --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama --lib-dir C:\Users\Admin\AppData\Local\Programs\Ollama\lib\ollama\vulkan
        13⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:10252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        8⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        
        PID:10168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff905c0c188,0x7ff905c0c194,0x7ff905c0c1a0
        9⤵
        
        PID:10208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,15805855993945368247,14357035728693197322,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:3
        9⤵
        System Time Discovery
        
        PID:8024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,4345659253756322721,15787887147615284963,262144 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
        9⤵
        
        PID:11432
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,7325560966375653782,10669893361226619249,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
        9⤵
        
        PID:11440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,4216908131993728082,16933275847566331940,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
        9⤵
        
        PID:7840
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,4216908131993728082,16933275847566331940,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
        9⤵
        
        PID:7852
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,9139539556424181511,14788811162594966326,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
        9⤵
        
        PID:10016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,4910696445837589461,17759774703781348952,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
        9⤵
        
        PID:3776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,10915197888513442026,15456927437789922130,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
        9⤵
        
        PID:728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,3013932660044013122,3869395417055313056,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        9⤵
        
        PID:1440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,6389241285750724746,10249353500392595638,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
        9⤵
        
        PID:8444
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4908,i,37325721306640764,15650941998854726385,262144 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
        9⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:7504
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,17365934148487498293,11203243062908851711,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
        9⤵
        
        PID:10204
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,16342349357850120579,7995489211988870621,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:8
        9⤵
        
        PID:8520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,17753775230821435577,17410398555601787018,524288 --field-trial-handle=2516,i,14295723600921420259,2632322371304346432,262144 --variations-seed-version --mojo-platform-channel-handle=1496 /prefetch:8
        9⤵
        
        PID:10400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6792,i,12515524710359026240,6080396682320929050,262144 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6808,i,1426806219007850858,14152157720573537598,524288 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6872,i,16019807111533607738,9862082399465940984,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=8876 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=9136,i,4900416328006133286,3198820816614315516,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9120 /prefetch:1
  2⤵
  PID:12220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=9172,i,8956653198920061528,11759478796423688113,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=9192 /prefetch:1
  2⤵
  PID:3064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=9020,i,5988906081085682623,6571766534022692982,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7644 /prefetch:1
  2⤵
  PID:8076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7720,i,1114929109425027627,14845472255073295971,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=7792 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=7712,i,18217508118751777777,297684771302926154,2097152 --field-trial-handle=2004,i,545693341423678344,16161639571300562698,262144 --variations-seed-version=20260911-010032.103000-production --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:8932

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5368

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding EA06A7BE0112451711D8662F996B7D69
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310\python.exe
    "C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310\python.exe
      C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8iobe1nu\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8iobe1nu\\pip-23.0.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp8iobe1nu', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:2980
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        Executes a command shell one-liner
        
        PID:5552

C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe
"C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe" /burn.runonce
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4936
- C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe
  "C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.10.11 (64-bit)_20260916235354.log" TargetDir=C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310 InstallAllUsers=0 PrependPath=0 Include_test=0 Include_launcher=0
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe
    "C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Package Cache\{a10fbb63-03ff-4b8c-a176-f5fd355f715b}\python-3.10.11-amd64.exe" -burn.filehandle.attached=516 -burn.filehandle.self=536 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Python 3.10.11 (64-bit)_20260916235354.log" TargetDir=C:\Users\Admin\AppData\Local\Programs\YUNA\runtime\python310 InstallAllUsers=0 PrependPath=0 Include_test=0 Include_launcher=0
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:7960

C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe
"C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe"
1⤵
- Executes dropped EXE
PID:7224
- C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe
  "C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious use of SetWindowsHookEx
  PID:8576
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:9412
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI00001c382\.yuna_state"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7148
  - - C:\Windows\system32\attrib.exe
      attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI00001c382\.yuna_state
      4⤵
      Views/modifies file attributes
      PID:10004
- - C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.EXE
    C:\Users\Admin\AppData\Local\Programs\Ollama\ollama.EXE pull qwen2.5:3b
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:10036
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:11928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:9648

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\YUNA\YUNA.log
1⤵
- Opens file in notepad (likely ransom note)
PID:10072

C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe
"C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe"
1⤵
- Executes dropped EXE
PID:12052
- C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe
  "C:\Users\Admin\AppData\Local\Programs\YUNA\YUNA.exe"
  2⤵
  - Executes dropped EXE
  - Checks SCSI registry key(s)
  - Suspicious use of SetWindowsHookEx
  PID:5044
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    - Executes a command shell one-liner
    PID:9404
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI00002f142\.yuna_state"
    3⤵
    - Hide Artifacts: Hidden Files and Directories
    PID:7568
  - - C:\Windows\system32\attrib.exe
      attrib +H +S C:\Users\Admin\AppData\Local\Temp\_MEI00002f142\.yuna_state
      4⤵
      Views/modifies file attributes
      PID:11064
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    PID:8144

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x118,0x11c,0x120,0xf8,0x124,0x7ff928e7c728,0x7ff928e7c734,0x7ff928e7c740
  2⤵
  PID:5840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery