phantom_stealer | b3217ca3543005ea9d318cda4abdc79af8079d9e1cd60c38e9c042bd8c0b6469

Peripheral Device Discovery

T1120

System Information Discovery

ioc	Process
\??\F:\	powershell.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Internet Connection Discovery

T1016.001

flow	ioc
9	icanhazip.com

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/4608-6-0x00000000051F0000-0x0000000005206000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4608 set thread context of 4372	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	92

Drops file in Windows directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\chrome_installer.log	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\msedge_installer.log	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\settings.dat	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\metadata	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\Crashpad\settings.dat	chrmstp.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\metadata	setup.exe
File opened for modification	C:\Windows\SystemTemp\MsEdgeCrashpad\throttle_store.dat	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4136	chrome.exe
5764	msedge.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{9F93E683-3709-4D9E-AD54-35C22D05CB65}	msedge.exe

Suspicious behavior: EnumeratesProcesses 51 IoCs

pid	Process
4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
2552	powershell.exe
2552	powershell.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
5012	chrome.exe
5012	chrome.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeDebugPrivilege	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Token: SeDebugPrivilege	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
Token: SeDebugPrivilege	2552	powershell.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe
Token: SeShutdownPrivilege	5012	chrome.exe
Token: SeCreatePagefilePrivilege	5012	chrome.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
5012	chrome.exe
5012	chrome.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
5760	firefox.exe
4444	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5760	firefox.exe
4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 2552	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	90
PID 4608 wrote to memory of 4372	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	92
PID 4608 wrote to memory of 4372	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	92
PID 4608 wrote to memory of 4372	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	92
PID 4608 wrote to memory of 4372	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	92
PID 4608 wrote to memory of 4372	4608	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	92
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 5012 wrote to memory of 3864	5012	chrome.exe	95
PID 4372 wrote to memory of 3864	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	95
PID 4372 wrote to memory of 3864	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	95
PID 5012 wrote to memory of 5044	5012	chrome.exe	96
PID 5012 wrote to memory of 4136	5012	chrome.exe	97
PID 5012 wrote to memory of 5024	5012	chrome.exe	98
PID 5012 wrote to memory of 5604	5012	chrome.exe	99
PID 5012 wrote to memory of 2504	5012	chrome.exe	100
PID 5012 wrote to memory of 3484	5012	chrome.exe	101
PID 5012 wrote to memory of 4916	5012	chrome.exe	102
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 5012 wrote to memory of 3172	5012	chrome.exe	103
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 5012 wrote to memory of 5928	5012	chrome.exe	104
PID 5012 wrote to memory of 2680	5012	chrome.exe	135
PID 4372 wrote to memory of 4136	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	97
PID 4372 wrote to memory of 4136	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	97
PID 4372 wrote to memory of 3864	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	95
PID 4372 wrote to memory of 3864	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	95
PID 4372 wrote to memory of 2680	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	135
PID 4372 wrote to memory of 2680	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	135
PID 4372 wrote to memory of 5044	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	96
PID 4372 wrote to memory of 5044	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	96
PID 4372 wrote to memory of 5024	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	98
PID 4372 wrote to memory of 5024	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	98
PID 4372 wrote to memory of 3484	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4372 wrote to memory of 3484	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4372 wrote to memory of 4916	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	102
PID 4372 wrote to memory of 4916	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	102
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 4372 wrote to memory of 3172	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	103
PID 4372 wrote to memory of 3172	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	103
PID 4372 wrote to memory of 2504	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	100
PID 4372 wrote to memory of 2504	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	100
PID 4372 wrote to memory of 5928	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 4372 wrote to memory of 5928	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 4372 wrote to memory of 4136	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	97
PID 4372 wrote to memory of 4136	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	97
PID 4372 wrote to memory of 3864	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	95
PID 4372 wrote to memory of 3864	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	95
PID 4372 wrote to memory of 5044	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	96
PID 4372 wrote to memory of 5044	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	96
PID 4372 wrote to memory of 5024	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	98
PID 4372 wrote to memory of 5024	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	98
PID 4372 wrote to memory of 3484	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4372 wrote to memory of 3484	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	101
PID 4372 wrote to memory of 4916	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	102
PID 4372 wrote to memory of 4916	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	102
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 4372 wrote to memory of 5012	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	94
PID 4372 wrote to memory of 3172	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	103
PID 4372 wrote to memory of 3172	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	103
PID 4372 wrote to memory of 2504	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	100
PID 4372 wrote to memory of 2504	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	100
PID 4372 wrote to memory of 5928	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104
PID 4372 wrote to memory of 5928	4372	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe

C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
"C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe
  "C:\Users\Admin\AppData\Local\Temp\KOÇKAR-ürünler Fiyat Teklifi Talebi projesi -29092026 SW 6504 VE SEO-5503.pdf.bat.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  - outlook_win_path
  PID:4372
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffe678bc728,0x7ffe678bc734,0x7ffe678bc740
      4⤵
      PID:3864
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1640,i,11676731398371403185,10445413677375524878,262144 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:2
      4⤵
      PID:5044
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=1928,i,15302264485087639127,14811216096840070398,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:11
      4⤵
      System Time Discovery
      PID:4136
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=2104,i,8487897779642619330,4360340649770254003,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:13
      4⤵
      PID:5024
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2920,i,7925609164674362821,17108591460756358382,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2924,i,14935273967483494974,8214365189189813777,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
      4⤵
      PID:2504
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3136,i,4042083978949625289,8526929502757117036,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:1
      4⤵
      PID:3484
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3148,i,8505257126032573515,68769003991891410,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:9
      4⤵
      PID:4916
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3212,i,1708737258294627830,10998358448442516129,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=4104 /prefetch:9
      4⤵
      PID:3172
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4260,i,7613176098740458873,15494156515879763888,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
      4⤵
      PID:5928
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=4324,i,3895925094877683737,9466646205223618687,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
      4⤵
      PID:2680
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=5116,i,10614417121968427140,11429013060033136401,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
      4⤵
      PID:4308
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5164,i,4261396607544999236,14360605983943550349,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
      4⤵
      PID:3268
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5184,i,17245644097954303128,14624737172220281729,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
      4⤵
      PID:5700
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:5304
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x2a0,0x2a4,0x2a8,0x27c,0x2ac,0x7ff7237455a0,0x7ff7237455ac,0x7ff7237455b8
        5⤵
        Drops file in Windows directory
        
        PID:3624
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        
        PID:4148
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x294,0x298,0x29c,0x26c,0x2a0,0x7ff7237455a0,0x7ff7237455ac,0x7ff7237455b8
        6⤵
        Drops file in Windows directory
        
        PID:3336
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5200,i,8175219621108986525,2145864142928142489,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
      4⤵
      PID:1328
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=5364,i,8527810271841657683,16304293690641241864,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
      4⤵
      PID:2396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,10409620827111317278,4226866304706414008,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:5860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5436,i,18438577524603501339,12976194172623981565,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5412,i,13826531977759965881,9759340737726699474,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
      4⤵
      PID:4088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5620,i,4041245957126567916,13282969861576582093,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
      4⤵
      PID:2556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5548,i,5420858493705760214,5987848110281385258,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
      4⤵
      PID:4816
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5560,i,11490092428717320814,1984847685525631200,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
      4⤵
      PID:5860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,8136881668476926608,11393924886847239423,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
      4⤵
      PID:704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=5584,i,1505478602531175068,11104247079915062380,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:14
      4⤵
      PID:1292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=3140,i,4714459073462721433,17291447845176570480,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:14
      4⤵
      PID:2740
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,4920852398700849514,6235914151439643593,524288 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
      4⤵
      PID:3300
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=5632,i,16019836770240220651,2597091142446550565,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:1
      4⤵
      PID:5688
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=5912,i,14917568059556813827,4820061243682801311,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:9
      4⤵
      PID:860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\lqrxfuxe.ve2" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6012,i,7567688036623586001,13090041242694058608,2097152 --field-trial-handle=1864,i,12122405817432538685,4571171335879606112,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:9
      4⤵
      PID:5708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\qvadroln.rol"
    3⤵
    PID:4648
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\qvadroln.rol
      4⤵
      Checks processor information in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:5760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1944 -prefsLen 27097 -prefMapHandle 1948 -prefMapSize 270279 -ipcHandle 2032 -initialChannelId {df86aa1b-52ca-48f4-8d08-ada9f19b2ea2} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:4588
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2188 -prefsLen 27133 -prefMapHandle 2284 -prefMapSize 270279 -ipcHandle 2396 -initialChannelId {68caa64c-b5ba-41f0-9904-00adaa73cb5a} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5540
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ba81de86-c2c7-4f19-83e3-cecaf587affa.dmp"
        5⤵
        
        PID:472
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2176 -prefsLen 27133 -prefMapHandle 2796 -prefMapSize 270279 -ipcHandle 2832 -initialChannelId {9a6bcdf6-3411-47d5-8f22-14b4f1852a60} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:2680
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\ea36d8a3-5fe7-477b-bfb2-7c1bcd721264.dmp"
        5⤵
        
        PID:3856
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2828 -prefsLen 27133 -prefMapHandle 2832 -prefMapSize 270279 -ipcHandle 3120 -initialChannelId {a6f6ddfd-a1b0-4d0a-9f55-cf9745fe1d50} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:1016
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\af3bfb85-3262-403e-bcff-bc2b1f624793.dmp"
        5⤵
        
        PID:5004
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3120 -prefsLen 27198 -prefMapHandle 3152 -prefMapSize 270279 -ipcHandle 3236 -initialChannelId {bac1ae76-2253-400a-b426-de2fd91e914b} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:2036
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\f6b10262-4377-48fd-a724-683da9e0895d.dmp"
        5⤵
        
        PID:5676
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2752 -prefsLen 27198 -prefMapHandle 2600 -prefMapSize 270279 -ipcHandle 2832 -initialChannelId {304ea049-8f00-44de-a60c-0421f4f447d4} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:2320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3928 -prefsLen 27323 -prefMapHandle 3932 -prefMapSize 270279 -jsInitHandle 3936 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3968 -initialChannelId {798d21a3-8d2a-495b-810d-b05ce87e629f} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        Checks processor information in registry
        
        PID:1196
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\cc78911f-7a90-4a4c-9ef9-ab5e6bc41862.dmp"
        5⤵
        
        PID:2376
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2832 -prefsLen 27323 -prefMapHandle 2944 -prefMapSize 270279 -ipcHandle 2572 -initialChannelId {eed99f88-11d3-4506-bf4e-5e6f415a6ab5} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:972
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8266ab14-eb9b-41de-9b76-1000c5c8b614.dmp"
        5⤵
        
        PID:3392
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3848 -prefsLen 27323 -prefMapHandle 3864 -prefMapSize 270279 -ipcHandle 4236 -initialChannelId {130794d8-1ce7-4b93-9005-3c3a85c84af4} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:4404
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4596 -prefsLen 34822 -prefMapHandle 4600 -prefMapSize 270279 -jsInitHandle 4604 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4612 -initialChannelId {4d298576-ef99-49cb-a4aa-ae0ea620ed3a} -parentPid 5760 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5760" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        Checks processor information in registry
        
        PID:1244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0"
    3⤵
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x230,0x260,0x264,0x22c,0x2c0,0x7ffe60d2c188,0x7ffe60d2c194,0x7ffe60d2c1a0
      4⤵
      PID:4684
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --always-read-main-dll --metrics-shmem-handle=1876,i,5208454290864876411,3490122556871450474,262144 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:2
      4⤵
      PID:4492
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,11809186082789986447,11937303389439145262,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=1676 /prefetch:11
      4⤵
      System Time Discovery
      PID:5764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,13988626718573028768,1249700178860295220,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
      4⤵
      PID:5248
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,3708479622206442322,15774921474011531474,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,17804200999270265581,14334458168241450168,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
      4⤵
      PID:984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3892,i,14360168734413986952,6729473211397234634,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:14
      4⤵
      PID:2808
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,14398860267733597937,15178636857881930746,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:14
      4⤵
      PID:6108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,8594265811999285959,5583713535204400446,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4040 /prefetch:14
      4⤵
      PID:5984
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4048,i,15685578760949635851,15356067618338604247,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
      4⤵
      PID:5724
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4092,i,2639670091247331702,12882421030975843427,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4080 /prefetch:9
      4⤵
      PID:2732
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4140,i,8255858559161223200,9532954182849031273,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
      4⤵
      PID:5532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4172,i,9136676406778538708,7558122349669400857,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:9
      4⤵
      PID:3240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4196,i,15174488063340828619,12935083303451806605,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4216,i,15572525255069095607,588187057144467312,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:9
      4⤵
      PID:5392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4228,i,11645612772252182693,6261470304353864679,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
      4⤵
      PID:3184
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4264,i,1850519647595631286,2710924217377622997,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
      4⤵
      PID:2276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4288,i,15025505724966385606,9016475962104684706,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:1
      4⤵
      PID:2348
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4352,i,17571758571500667593,10751454044053158987,2097152 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:9
      4⤵
      PID:3268
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,17923180728381182357,9784526154958980130,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:14
      4⤵
      PID:2888
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=1156
        5⤵
        
        PID:5756
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,17225038162741486598,13411102620156037781,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
      4⤵
      PID:2428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,9581821352513451339,8877223691087379054,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
      4⤵
      PID:3328
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
        
        cookie_exporter.exe --cookie-json=624
        5⤵
        
        PID:4280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,16577785987601727299,1421788018300362924,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:14
      4⤵
      PID:1072
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,326739468590238339,2968812153031615958,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
      4⤵
      PID:6096
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --no-sandbox --mute-audio --onnx-enabled-for-ee --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,505667648465108266,5187536519526769599,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
      4⤵
      PID:1360
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,8158643732059186136,15066357100841061870,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:3012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,8158643732059186136,15066357100841061870,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:14
      4⤵
      PID:1900
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
      4⤵
      Drops file in Windows directory
      PID:4692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff6d0c404c8,0x7ff6d0c404d4,0x7ff6d0c404e0
        5⤵
        Drops file in Windows directory
        
        PID:6260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --msedge --system-level --verbose-logging --installerdata="C:\Program Files (x86)\Microsoft\Edge\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        
        PID:6308
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x1d8,0x240,0x7ff6d0c404c8,0x7ff6d0c404d4,0x7ff6d0c404e0
        6⤵
        Drops file in Windows directory
        
        PID:6352
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\zojeduqg.ef0" --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,6179477559213463490,1917745796382778157,524288 --field-trial-handle=2568,i,8238224077948053920,3658360045107090440,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
      4⤵
      PID:3012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:2832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery