c6bd3da755f382466610ed96d363e701cf044819b925684896af26b797abaa6d

Processes:

msedge.exereg.exemsedge.exereg.exemsedge.exesetup.exesetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window --win-session-start /prefetch:5"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicrosoftEdgeAutoLaunch_5EFC0ECB77A7585FE9DCDD0B2E946A2B = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --no-startup-window /prefetch:5"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	setup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

msedge.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA msedge.exe
Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	msedge.exe

Drops file in System32 directory 2 IoCs

Processes:

setup.exebootim.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe
File opened for modification	C:\Windows\system32\Recovery\ReAgent.xml	bootim.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

Processes:

werfault.exe

pid process

4912 werfault.exe

pid	process
4912	werfault.exe

Drops file in Program Files directory 64 IoCs

Processes:

MicrosoftEdgeUpdateSetup.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\identity_proxy\internal.identity_helper.exe.manifest	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\nacl_irt_x86_64.nexe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\hi.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\microsoft_apis.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\vcruntime140_1.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\msedge.exe.sig	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\ga.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\identity_proxy\identity_helper.Sparse.Dev.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\nacl_irt_x86_64.nexe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\fr.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\hu.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\identity_proxy\identity_helper.Sparse.Beta.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Notifications\SoftLandingAssetLight.gif	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\96.0.1054.34\MicrosoftEdge_X64_96.0.1054.34.exe	MicrosoftEdgeUpdate.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\96.0.1054.34.manifest	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_iw.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_kn.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1A2A.tmp\msedgeupdateres_fr-CA.dll	MicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\MLModels\autofill_labeling_features.txt	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\MLModels\autofill_labeling_features_email.txt	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1A2A.tmp\msedgeupdateres_nl.dll	MicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Locales\ta.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\af.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Mu\Cryptomining	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ml.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_ar.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_ja.dll	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\telclient.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Trust Protection Lists\Sigma\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\nl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\VisualElements\SmallLogoBeta.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\icudtl.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1A2A.tmp\msedgeupdateres_ru.dll	MicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Trust Protection Lists\Mu\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\kok.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_is.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ca-Es-VALENCIA.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Trust Protection Lists\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Trust Protection Lists\Sigma\Staging	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_ca.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_sv.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\MicrosoftEdgeUpdateSetup.exe	MicrosoftEdgeUpdateSetup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\te.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\te.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\microsoft_apis.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\msedgeupdateres_sl.dll	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Trust Protection Lists\Sigma\Analytics	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\onnxruntime.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\MLModels\autofill_labeling_features_email.txt	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\cs.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ro.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\MEIPreload\manifest.json	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\96.0.1054.34\Locales\ta.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\MicrosoftEdgeComRegisterShellARM64.exe	MicrosoftEdgeUpdateSetup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU1A2A.tmp\msedgeupdateres_gl.dll	MicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\sk.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\96.0.1054.34\Locales\ro.pak	setup.exe

Drops file in Windows directory 28 IoCs

Processes:

SystemSettings.exeSystemSettings.exebootim.exesvchost.exeUserOOBEBroker.exeUserOOBEBroker.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	SystemSettings.exe
File created	C:\Windows\Panther\UnattendGC\mndDE11.diagerr.mdmp	SystemSettings.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	SystemSettings.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	SystemSettings.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	SystemSettings.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettings.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	SystemSettings.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	SystemSettings.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\ServiceState\WinHttpAutoProxySvc\Data\cachev3.dat	svchost.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	bootim.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	SystemSettings.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	bootim.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4060 936 WerFault.exe SystemSettings.exe

pid	pid_target	process	target process
4060	936	WerFault.exe	SystemSettings.exe

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

SystemSettings.exeSystemSettings.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Sanu&Prod_Sanu_DVD-ROM\4&135b206d&0&010000\HardwareID	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&135b206d&0&000000\HardwareID	SystemSettings.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exeWerFault.exeSystemSettings.exewerfault.exeSystemSettings.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	WerFault.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	werfault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	werfault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	werfault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	werfault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	werfault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1	werfault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	werfault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Enumerates system info in registry 2 TTPs 19 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exemsedge.exeWerFault.exemsedge.exemsedge.exeSystemSettings.exewerfault.exeSystemSettings.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SystemSettings.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	werfault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	SystemSettings.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	werfault.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	SystemSettings.exe

Modifies Control Panel 1 IoCs
evasion

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Colors msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000\Control Panel\Colors	msedge.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\96.0.1054.34\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\96.0.1054.34\\BHO"	setup.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

WaaSMedicAgent.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeLogonUI.exeWaaSMedicAgent.exesvchost.exeSystemSettingsAdminFlows.exesvchost.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Control Panel\International\TzNotification	SystemSettingsAdminFlows.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	WaaSMedicAgent.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	WaaSMedicAgent.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exereg.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{2E1DD7EF-C12D-4F8E-8AD8-CF8CC265BAD0}\ELEVATION	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\VersionIndependentProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{77857D02-7A25-4B67-9266-3E122A8F39E4}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.151.27\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FEA2518F-758F-4B95-A59F-97FCEEF1F5D0}\ = "IPolicyStatus"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\shell\runas\command\ = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --do-not-de-elevate --single-argument %1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\ = "IAppCommand2"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E55B90F1-DA33-400B-B09E-3AFF7D46BD83}\NumMethods\ = "9"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\MicrosoftEdgeUpdateBroker.exe\""	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-257790753-2419383948-818201544-1000_Classes\Discord\ = "URL:Discord Protocol"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\NumMethods\ = "41"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3WebMachineFallback\ = "Microsoft Edge Update Update3Web"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B5977F34-9264-4AC3-9B31-1224827FF6E8}\LocalServer32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\ = "Microsoft Edge HTML Document"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\INPROCSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\Implemented Categories\	setup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSEdgeHTM	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\ProxyStubClsid32\ = "{B4A02D72-2A34-41DB-B37F-05DFDB27E933}"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\ProxyStubClsid32\ = "{B532B342-0E34-448B-9EDF-1D55C04041F8}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\ = "IRegistrationUpdateHook"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8F09CD6C-5964-4573-82E3-EBFF7702865B}\ProgID	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\{A6B716CB-028B-404D-B72C-50E153DD68DA}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ = "IGoogleUpdateCore"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\NumMethods\ = "24"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{195A2EB3-21EE-43CA-9F23-93C2C9934E2E}\ = "IApp"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{CECDDD22-2E72-4832-9606-A9B0E5E344B2}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EA92A799-267E-4DF5-A6ED-6A7E0684BB8A}\AppID = "{A6B716CB-028B-404D-B72C-50E153DD68DA}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ = "IProcessLauncher"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FCE48F77-C677-4012-8A1A-54D2E2BC07BD}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D1E8B1A6-32CE-443C-8E2E-EBA90C481353}\ProgID	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EADE5C79-5190-49C1-AA39-AFF5E19DE0A2}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.153.53\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7E29BE61-5809-443F-9B5D-CF22156694EB}\NumMethods\ = "12"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.PolicyStatusMachineFallback\ = "Google Update Policy Status Class"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\NumMethods\ = "13"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ = "IGoogleUpdate"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{177CAE89-4AD6-42F4-A458-00EC3389E3FE}\ = "ICurrentState"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABD63202-F52F-4225-9C85-19DD88589B66}\InprocHandler32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MicrosoftEdgeUpdate.Update3COMClassService.1.0\CLSID\ = "{CECDDD22-2E72-4832-9606-A9B0E5E344B2}"	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3A49F783-1C7D-4D35-8F63-5C1C206B9B6E}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe

Modifies registry key 1 TTPs 11 IoCs

Modify Registry
T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

pid process

3488 reg.exe
3724 reg.exe
4616 reg.exe
2196 reg.exe
3984 reg.exe
480 reg.exe
2260 reg.exe
2296 reg.exe
2596 reg.exe
5020 reg.exe
1512 reg.exe

pid	process
3488	reg.exe
3724	reg.exe
4616	reg.exe
2196	reg.exe
3984	reg.exe
480	reg.exe
2260	reg.exe
2296	reg.exe
2596	reg.exe
5020	reg.exe
1512	reg.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

Discord.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Discord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Discord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	Discord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 040000000100000010000000d474de575c39b2d39c8583c5c065498a0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc25190000000100000010000000ba4f3972e7aed9dccdc210db59da13c92000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Discord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 5c000000010000000400000000080000190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc36200000001000000200000007431e5f4c3c1ce4690774f0b61e05440883ba9a01ed00ba6abd7806ed3b118cf090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8040000000100000010000000d474de575c39b2d39c8583c5c065498a2000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	Discord.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	Discord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Discord.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	Discord.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Discord.exeDiscord.exeDiscord.exeDiscord.exeDiscord.exeDiscord.exeDiscord.exemsedge.exemsedge.exe

pid	process
3440	Discord.exe
3440	Discord.exe
3440	Discord.exe
3440	Discord.exe
3440	Discord.exe
3440	Discord.exe
3440	Discord.exe
3440	Discord.exe
3436	Discord.exe
3436	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
1776	Discord.exe
1776	Discord.exe
1608	Discord.exe
1608	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
5668	Discord.exe
5668	Discord.exe
4872	Discord.exe
4872	Discord.exe
5936	msedge.exe
5936	msedge.exe
5216	msedge.exe
5216	msedge.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe
4872	Discord.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Discord.exe

pid process

4872 Discord.exe
Suspicious behavior: LoadsDriver 10 IoCs

Processes:

pid process

696
696
696
696
696
696
696
696
696
696
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

werfault.exe

pid process

4912 werfault.exe

pid	process
4872	Discord.exe

pid	process
696
696
696
696
696
696
696
696
696
696

pid	process
4912	werfault.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 54 IoCs

Processes:

msedge.exemsedge.exemsedge.exe

pid	process
5216	msedge.exe
5216	msedge.exe
5216	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

svchost.exesvchost.exeWaaSMedicAgent.exeSystemSettings.exesvchost.exeDiscord.exeDiscordHookHelper64.exeDiscordHookHelper.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_96.0.1054.34.exesetup.exeMicrosoftEdge_X64_96.0.1054.34.exesetup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	pid	process
Token: SeShutdownPrivilege	1840	svchost.exe
Token: SeCreatePagefilePrivilege	1840	svchost.exe
Token: SeShutdownPrivilege	1840	svchost.exe
Token: SeCreatePagefilePrivilege	1840	svchost.exe
Token: SeShutdownPrivilege	1840	svchost.exe
Token: SeCreatePagefilePrivilege	1840	svchost.exe
Token: SeShutdownPrivilege	1080	svchost.exe
Token: SeCreatePagefilePrivilege	1080	svchost.exe
Token: SeTakeOwnershipPrivilege	452	WaaSMedicAgent.exe
Token: SeSecurityPrivilege	452	WaaSMedicAgent.exe
Token: SeRestorePrivilege	452	WaaSMedicAgent.exe
Token: SeBackupPrivilege	452	WaaSMedicAgent.exe
Token: SeShutdownPrivilege	1840	svchost.exe
Token: SeCreatePagefilePrivilege	1840	svchost.exe
Token: SeShutdownPrivilege	936	SystemSettings.exe
Token: SeCreatePagefilePrivilege	936	SystemSettings.exe
Token: SeShutdownPrivilege	936	SystemSettings.exe
Token: SeCreatePagefilePrivilege	936	SystemSettings.exe
Token: SeShutdownPrivilege	936	SystemSettings.exe
Token: SeCreatePagefilePrivilege	936	SystemSettings.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: 33	4872	Discord.exe
Token: SeIncBasePriorityPrivilege	4872	Discord.exe
Token: SeDebugPrivilege	1336	DiscordHookHelper64.exe
Token: SeDebugPrivilege	1340	DiscordHookHelper.exe
Token: SeDebugPrivilege	452	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	452	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2792	MicrosoftEdgeUpdate.exe
Token: 33	3936	MicrosoftEdgeUpdate.exe
Token: SeIncBasePriorityPrivilege	3936	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2172	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5864	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5972	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	3476	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5696	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5548	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5548	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4464	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4060	MicrosoftEdgeUpdate.exe
Token: 33	5548	MicrosoftEdgeUpdate.exe
Token: SeIncBasePriorityPrivilege	5548	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4464	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4464	MicrosoftEdgeUpdate.exe
Token: 33	5252	MicrosoftEdge_X64_96.0.1054.34.exe
Token: SeIncBasePriorityPrivilege	5252	MicrosoftEdge_X64_96.0.1054.34.exe
Token: 33	1976	setup.exe
Token: SeIncBasePriorityPrivilege	1976	setup.exe
Token: 33	4712	MicrosoftEdge_X64_96.0.1054.34.exe
Token: SeIncBasePriorityPrivilege	4712	MicrosoftEdge_X64_96.0.1054.34.exe
Token: 33	5840	setup.exe
Token: SeIncBasePriorityPrivilege	5840	setup.exe
Token: SeDebugPrivilege	5436	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	4896	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	5180	MicrosoftEdgeUpdate.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe
Token: SeTcbPrivilege	3740	svchost.exe

Suspicious use of FindShellTrayWindow 39 IoCs

Processes:

Update.exeDiscord.exeSystemSettings.exemsedge.exemsedge.exemsedge.exe

pid	process
856	Update.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
936	SystemSettings.exe
4444	Discord.exe
4444	Discord.exe
5216	msedge.exe
5216	msedge.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
5572	msedge.exe
5104	msedge.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe

Suspicious use of SendNotifyMessage 32 IoCs

Processes:

Discord.exemsedge.exe

pid	process
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
5572	msedge.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe
4444	Discord.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

SystemSettings.exeDiscordHookHelper.exeDiscordHookHelper64.exeMiniSearchHost.exeSystemSettings.exeSystemSettingsAdminFlows.exeLogonUI.exe

pid	process
936	SystemSettings.exe
1264	DiscordHookHelper.exe
5520	DiscordHookHelper64.exe
2268	MiniSearchHost.exe
4984	SystemSettings.exe
5720	SystemSettingsAdminFlows.exe
3500	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

DiscordSetup.exesvchost.exeUpdate.exeDiscord.exe

description	pid	process	target process
PID 5096 wrote to memory of 856	5096	DiscordSetup.exe	Update.exe
PID 5096 wrote to memory of 856	5096	DiscordSetup.exe	Update.exe
PID 5096 wrote to memory of 856	5096	DiscordSetup.exe	Update.exe
PID 1080 wrote to memory of 1544	1080	svchost.exe	MoUsoCoreWorker.exe
PID 1080 wrote to memory of 1544	1080	svchost.exe	MoUsoCoreWorker.exe
PID 856 wrote to memory of 3440	856	Update.exe	Discord.exe
PID 856 wrote to memory of 3440	856	Update.exe	Discord.exe
PID 856 wrote to memory of 3440	856	Update.exe	Discord.exe
PID 3440 wrote to memory of 1364	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 1364	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 1364	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 4120	3440	Discord.exe	Update.exe
PID 3440 wrote to memory of 4120	3440	Discord.exe	Update.exe
PID 3440 wrote to memory of 4120	3440	Discord.exe	Update.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3272	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3436	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3436	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 3436	3440	Discord.exe	Discord.exe
PID 3440 wrote to memory of 480	3440	Discord.exe	reg.exe
PID 3440 wrote to memory of 480	3440	Discord.exe	reg.exe
PID 3440 wrote to memory of 480	3440	Discord.exe	reg.exe
PID 3440 wrote to memory of 2260	3440	Discord.exe	reg.exe
PID 3440 wrote to memory of 2260	3440	Discord.exe	reg.exe
PID 3440 wrote to memory of 2260	3440	Discord.exe	reg.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

Processes:

msedge.exesetup.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedge.exe

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2924

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetTimeZoneAutoUpdate 0
2⤵
PID:4544

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetTimeZoneAutoUpdate 0
2⤵
- Modifies data under HKEY_USERS
PID:6064

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 0
2⤵
PID:256

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" SetInternetTime 1
2⤵
PID:5468

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" FeaturedResetPC
2⤵
- Suspicious use of SetWindowsHookEx
PID:5720

C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe
"C:\Users\Admin\AppData\Local\Temp\DiscordSetup.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5096

C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:856

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --squirrel-install 1.0.9003
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3440

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9003 --annotation=prod=Electron --annotation=ver=13.4.0 --initial-client-data=0x478,0x47c,0x480,0x474,0x484,0x7598820,0x7598830,0x759883c
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1364

C:\Users\Admin\AppData\Local\Discord\Update.exe
C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
4⤵
- Executes dropped EXE
PID:4120

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=gpu-process --field-trial-handle=1680,140013293201451313,7099945613876548290,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1700 /prefetch:2
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3272

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1680,140013293201451313,7099945613876548290,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 /prefetch:8
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3436

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
4⤵
- Adds Run key to start application
- Modifies registry key
PID:480

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
4⤵
- Modifies registry key
PID:2260

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
4⤵
- Modifies registry key
PID:3488

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe\",-1" /f
4⤵
- Modifies registry key
PID:2296

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe\" --url -- \"%1\"" /f
4⤵
- Modifies registry key
PID:2596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:584

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 197336ded18d3966a5fbced7cdf6571a 1ZmZbwWy60mrfX09VqzRrQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:1544

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:1388

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:2364

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:4004

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:3084

C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
C:\Windows\uus\AMD64\MoUsoCoreWorker.exe
2⤵
PID:824

C:\Windows\System32\sihclient.exe
C:\Windows\System32\sihclient.exe /cv 1ZmZbwWy60mrfX09VqzRrQ.0.2
1⤵
PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:976

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe 197336ded18d3966a5fbced7cdf6571a 1ZmZbwWy60mrfX09VqzRrQ.0.1.0.3.0
1⤵
- Modifies data under HKEY_USERS
PID:2156

C:\Users\Admin\AppData\Local\Discord\Update.exe
"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
1⤵
- Executes dropped EXE
PID:1092

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4444

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9003 --annotation=prod=Electron --annotation=ver=13.4.0 --initial-client-data=0x470,0x474,0x478,0x46c,0x47c,0x7598820,0x7598830,0x759883c
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4056

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=gpu-process --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1672 /prefetch:2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3168

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
3⤵
- Modifies registry class
- Modifies registry key
PID:5020

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:8
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1776

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2508 /prefetch:1
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1608

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
3⤵
- Modifies registry key
PID:3724

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe\",-1" /f
3⤵
- Modifies registry key
PID:4616

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe\" --url -- \"%1\"" /f
3⤵
- Modifies registry key
PID:2196

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2804 /prefetch:1 --enable-node-leakage-in-renderers
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4872

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /q /d /s /c "C:\Program^ Files\NVIDIA^ Corporation\NVSMI\nvidia-smi.exe"
4⤵
PID:6056

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:5668

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:4636

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:5644

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5712

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:2464

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:6020

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:5952

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5936

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:5064

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:2200

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:5276

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:1248

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5732

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:3136

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:4904

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5480

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:4816

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:1208

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5956

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:4432

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:4664

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:560

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:3496

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:4084

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5460

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper.exe
\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper.exe offsets 274877911816
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1264

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper64.exe
\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper64.exe offsets 137438958344
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5520

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper64.exe
\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper64.exe inject DiscordHook64.dll 0 5572
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:1884

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:3236

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:5056

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:4248

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:1008

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:2904

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:5104

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:3644

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:1900

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:3736

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:416

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:2004

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:1500

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:4424

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:6096

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper.exe
\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper.exe inject DiscordHook.dll 0 856
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1340

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
- Executes dropped EXE
PID:1068

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
- Executes dropped EXE
PID:2988

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
- Executes dropped EXE
PID:5244

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:5036

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:6000

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
PID:6020

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1336

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:2052

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
PID:5532

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1280

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:5112

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:416

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
PID:2004

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4424

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:6096

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
PID:932

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:2360

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:2392

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 5572 d3d12.dll
4⤵
PID:4588

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:5696

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:5504

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:5556

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:3136

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4728

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1244

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4080

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1084

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4112

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:3092

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:3680

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:5220

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:2896

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1572

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4824

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1940

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:3588

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:6072

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:256

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:1372

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4464

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:812

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:5968

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:4592

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:5044

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:248

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4268

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:292

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper.exe
\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_hook-1\discord_hook\2b6f62ed4f4\DiscordHookHelper.exe inject DiscordHook.dll 0 4444
4⤵
PID:4156

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:1280

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:1840

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:3368

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:4856

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:4148

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:2100

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:5932

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:2940

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:2424

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 4444 d3d12.dll
4⤵
PID:1452

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe
"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\modules\discord_voice-4\discord_voice\capture_helper.exe" 856 d3d12.dll
4⤵
PID:5956

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3984 /prefetch:8
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5628

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3992 /prefetch:8
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=2a70569c-fad1-43aa-a114-4afc121b16f7
3⤵
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcbb0946f8,0x7ffcbb094708,0x7ffcbb094718
4⤵
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,13548705465259459264,11326175473683666677,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
4⤵
PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,13548705465259459264,11326175473683666677,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,13548705465259459264,11326175473683666677,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
4⤵
PID:1308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13548705465259459264,11326175473683666677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
4⤵
PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13548705465259459264,11326175473683666677,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
4⤵
PID:3984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,13548705465259459264,11326175473683666677,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4444 /prefetch:1
4⤵
PID:5992

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord
3⤵
- Modifies registry key
PID:3984

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:1512

C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe
"C:\Users\Admin\AppData\Local\Discord\app-1.0.9003\Discord.exe" --type=gpu-process --field-trial-handle=1652,9113317415708114879,15354172572374581408,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=880 /prefetch:2
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:936

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 936 -s 3592
2⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4060

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s BthAvctpSvc
1⤵
PID:5172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:5308

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5472

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:5556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.107 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.62 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffccd0346f8,0x7ffccd034708,0x7ffccd034718
2⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
2⤵
PID:248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
2⤵
PID:2196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
2⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
2⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
2⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
2⤵
PID:1828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3876 /prefetch:8
2⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
2⤵
PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
2⤵
PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
2⤵
PID:668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
2⤵
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 /prefetch:8
2⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6056 /prefetch:8
2⤵
PID:5936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3596 /prefetch:1
2⤵
PID:2912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6564 /prefetch:8
2⤵
PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1040 /prefetch:2
2⤵
PID:5820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6788 /prefetch:8
2⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6556 /prefetch:8
2⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5568 /prefetch:8
2⤵
PID:5956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6748 /prefetch:8
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5564 /prefetch:8
2⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4404 /prefetch:8
2⤵
PID:5468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3680 /prefetch:8
2⤵
PID:2052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2560 /prefetch:1
2⤵
PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
2⤵
PID:3556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4060 /prefetch:8
2⤵
PID:1976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6396 /prefetch:8
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
2⤵
PID:3872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
2⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
2⤵
PID:2236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.PageScreenshotProcessor --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5796 /prefetch:8
2⤵
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:1
2⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
2⤵
PID:576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
2⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7228 /prefetch:1
2⤵
PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
2⤵
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
2⤵
PID:4596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:1
2⤵
PID:5864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
2⤵
PID:2056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6376 /prefetch:1
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8356 /prefetch:1
2⤵
PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8092 /prefetch:1
2⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7572 /prefetch:1
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8624 /prefetch:1
2⤵
PID:5616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8972 /prefetch:1
2⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9368 /prefetch:1
2⤵
PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8964 /prefetch:1
2⤵
PID:1304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9636 /prefetch:1
2⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9752 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9260 /prefetch:1
2⤵
PID:4092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10116 /prefetch:1
2⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10040 /prefetch:1
2⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10276 /prefetch:1
2⤵
PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10316 /prefetch:1
2⤵
PID:2568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10368 /prefetch:1
2⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10396 /prefetch:1
2⤵
PID:3392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10544 /prefetch:1
2⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9340 /prefetch:1
2⤵
PID:3580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9184 /prefetch:1
2⤵
PID:1252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,3170198927186214111,16288616603245565021,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8840 /prefetch:1
2⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window /prefetch:5
2⤵
- Enumerates system info in registry
- System policy modification
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=96.0.4664.55 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=96.0.1054.34 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd063a740,0x7ffcd063a750,0x7ffcd063a760
3⤵
PID:2896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,9507871376896950428,4583546990303575820,131072 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
3⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,9507871376896950428,4583546990303575820,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
3⤵
PID:2988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3740

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:2268

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 408 -p 936 -ip 936
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.62\elevation_service.exe"
1⤵
PID:1100

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1100_2051141148\msedgerecovery.exe
"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1100_2051141148\msedgerecovery.exe" --appguid={56EB18F8-B008-4CBD-B6D2-8C97FE7E9062} --browser-version=92.0.902.62 --sessionid={34de1386-6c3f-456f-b5ab-a0d17fc4847f} --system
2⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1100_2051141148\MicrosoftEdgeUpdateSetup.exe
"C:\Program Files (x86)\Microsoft\Edge\MSEdgeRecovery\scoped_dir1100_2051141148\MicrosoftEdgeUpdateSetup.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
3⤵
- Drops file in Program Files directory
PID:1728

C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU929B.tmp\MicrosoftEdgeUpdate.exe" /install "runtime=true&needsadmin=true" /installsource chromerecovery /silent
4⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
5⤵
- Loads dropped DLL
- Modifies registry class
PID:4080

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
5⤵
- Loads dropped DLL
- Modifies registry class
PID:2500

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Loads dropped DLL
- Modifies registry class
PID:5828

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Loads dropped DLL
- Modifies registry class
PID:1872

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.151.27\MicrosoftEdgeUpdateComRegisterShell64.exe"
6⤵
- Loads dropped DLL
- Modifies registry class
PID:5676

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTEuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QkY3MzZGODUtNzc2RS00QzRFLThGMzctNjIzMDRGQTdGMDhDfSIgdXNlcmlkPSJ7QzAyN0NGQzYtNTc0Qi00MDkzLTlFRjktRjc4NTk4QkNFN0NDfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezlFNzkyNjlBLUM1MUQtNDNCNy05NkMzLTIwQkIyODRFMDJCN30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjAiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuMTAwIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS4zLjE1MS4yNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMjczIi8-PC9hcHA-PC9yZXF1ZXN0Pg
5⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /machine /installsource chromerecovery
3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5864

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Loads dropped DLL
PID:5284

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3936

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:2172

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Loads dropped DLL
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5972

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A3A9A92D-2FF1-4B8D-8765-056C3AD7A806}\MicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{A3A9A92D-2FF1-4B8D-8765-056C3AD7A806}\MicrosoftEdgeUpdateSetup_X86_1.3.153.53.exe" /update /sessionid "{26A1C3B2-7E93-4596-96AE-8AF482CE0E7D}"
2⤵
- Drops file in Program Files directory
PID:4116

C:\Program Files (x86)\Microsoft\Temp\EU1A2A.tmp\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\Temp\EU1A2A.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{26A1C3B2-7E93-4596-96AE-8AF482CE0E7D}"
3⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:5696

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
4⤵
- Loads dropped DLL
- Modifies registry class
PID:3592

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
4⤵
- Loads dropped DLL
- Modifies registry class
PID:3044

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:4796

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:5488

C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.153.53\MicrosoftEdgeUpdateComRegisterShell64.exe"
5⤵
- Loads dropped DLL
- Modifies registry class
PID:5796

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTMuNTMiIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjZBMUMzQjItN0U5My00NTk2LTk2QUUtOEFGNDgyQ0UwRTdEfSIgdXNlcmlkPSJ7QzAyN0NGQzYtNTc0Qi00MDkzLTlFRjktRjc4NTk4QkNFN0NDfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7QUYwNjMwOUQtOUNBQy00QzYzLUI3MzAtQTA2MDMwNTFFMENEfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMCIgc3NlNDE9IjAiIHNzZTQyPSIwIiBhdng9IjAiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC4xMDAiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTUxLjI3IiBuZXh0dmVyc2lvbj0iMS4zLjE1My41MyIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjaHJvbWVyZWMzPTIwMjE0OFIiIGluc3RhbGxhZ2U9IjExOCIgaW5zdGFsbGRhdGV0aW1lPSIxNjI4MTIxMzE2IiBjb2hvcnQ9InJyZkAwLjA5Ij48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
4⤵
- Suspicious use of AdjustPrivilegeToken
PID:4060

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTEuMjciIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MjZBMUMzQjItN0U5My00NTk2LTk2QUUtOEFGNDgyQ0UwRTdEfSIgdXNlcmlkPSJ7QzAyN0NGQzYtNTc0Qi00MDkzLTlFRjktRjc4NTk4QkNFN0NDfSIgaW5zdGFsbHNvdXJjZT0iY2hyb21lcmVjb3ZlcnkiIHJlcXVlc3RpZD0iezNCMDc4ODYxLUYxQUItNDc5RS04MzM3LTI0MUI0MTYxMTI4MX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgbG9naWNhbF9jcHVzPSIyIiBwaHlzbWVtb3J5PSI0IiBkaXNrX3R5cGU9IjIiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjAiIHNzZTQxPSIwIiBzc2U0Mj0iMCIgYXZ4PSIwIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuMTAwIiBzcD0iIiBhcmNoPSJ4NjQiLz48b2VtIHByb2R1Y3RfbWFudWZhY3R1cmVyPSJEQURZIiBwcm9kdWN0X25hbWU9IlN0YW5kYXJkIFBDIChRMzUgKyBJQ0g5LCAyMDA5KSIvPjxleHAgZXRhZz0iJnF1b3Q7cjQ1MnQxK2syVGdxL0hYemp2Rk5CUmhvcEJXUjlzYmpYeHFlVURIOXVYMD0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE1MS4yNyIgbmV4dHZlcnNpb249IjEuMy4xNTMuNTMiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY2hyb21lcmVjMz0yMDIxNDhSIiBpbnN0YWxsYWdlPSIxMTgiIGNvaG9ydD0icnJmQDAuMDkiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuYi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy9hMWQ0MjdlNi00ZjdhLTQzNTQtYmQwMC0wNjAwMmEwZTE5OGM_UDE9MTYzODk4NDE2NCZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1rWmFKeGhyMiUyZlY5c2k2STE4S3JYM2ZLQmNQMDQ5MGlZaEVMSTcxYVZlSWY5R3NnWEZWeEhHSmhLNG8wNFMwOE1pRzZoZFYxaDB2JTJmZ0txJTJmbmhjdXB1ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgZG93bmxvYWRlZD0iMTc3OTYxNiIgdG90YWw9IjE3Nzk2MTYiIGRvd25sb2FkX3RpbWVfbXM9IjM4NiIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzb3VyY2VfdXJsX2luZGV4PSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48cGluZyByPSIxMTkiIHJkPSI1MzI5IiBwaW5nX2ZyZXNobmVzcz0ie0JCRUM0NUNBLUE2Q0EtNEEzNi05ODRFLTQ1RThCNjU0QzFGMX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjIiIG5leHR2ZXJzaW9uPSIiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBsYXN0X2xhdW5jaF90aW1lPSIxMzI4Mjg1MjM5NzM4MjI3NiI-PHVwZGF0ZWNoZWNrLz48cGluZyBhY3RpdmU9IjEiIGE9IjEyOCIgcj0iMTE5IiBhZD0iNTMyMCIgcmQ9IjUzMjkiIHBpbmdfZnJlc2huZXNzPSJ7MDZCNzg4OEEtQzcwMS00MkMyLTk5REEtNUZGRjhFNDU0NzE0fSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42MiIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGNvaG9ydD0icnJmQDAuNDIiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMjcxNzQ1OTE1MDg5NTYyIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMCIgcj0iMTE5IiByZD0iNTMyOSIgcGluZ19mcmVzaG5lc3M9IntFODY1RENDMS1CRDI1LTQyODYtODZFNS0xNzFDNjc2MjkyMEV9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
PID:3476

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Loads dropped DLL
PID:4432

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /c
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5548

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4464

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource core
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5180

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5436

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E7D27C3-B524-4F5D-A8E1-87882DB9AAEC}\MicrosoftEdge_X64_96.0.1054.34.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E7D27C3-B524-4F5D-A8E1-87882DB9AAEC}\MicrosoftEdge_X64_96.0.1054.34.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5252

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E7D27C3-B524-4F5D-A8E1-87882DB9AAEC}\EDGEMITMP_3842B.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E7D27C3-B524-4F5D-A8E1-87882DB9AAEC}\EDGEMITMP_3842B.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{8E7D27C3-B524-4F5D-A8E1-87882DB9AAEC}\EDGEMITMP_3842B.tmp\MSEDGE.PACKED.7Z" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
3⤵
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1976

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{438C4753-703B-4B5D-AAFE-5B4F22BB2E9C}\MicrosoftEdge_X64_96.0.1054.34.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{438C4753-703B-4B5D-AAFE-5B4F22BB2E9C}\MicrosoftEdge_X64_96.0.1054.34.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4712

C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{438C4753-703B-4B5D-AAFE-5B4F22BB2E9C}\EDGEMITMP_E4CBF.tmp\setup.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{438C4753-703B-4B5D-AAFE-5B4F22BB2E9C}\EDGEMITMP_E4CBF.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{438C4753-703B-4B5D-AAFE-5B4F22BB2E9C}\EDGEMITMP_E4CBF.tmp\MSEDGE.PACKED.7Z" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
3⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNTMuNTMiIHNoZWxsX3ZlcnNpb249IjEuMy4xNDMuNTciIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7OEU0MDY5MEItN0VCNy00NzAxLTk1MDUtN0Y0MTcyMDNCQjMxfSIgdXNlcmlkPSJ7QzAyN0NGQzYtNTc0Qi00MDkzLTlFRjktRjc4NTk4QkNFN0NDfSIgaW5zdGFsbHNvdXJjZT0iY29yZSIgcmVxdWVzdGlkPSJ7QzEwNDU0MjAtNjQ2NS00MTU1LTlDMzktMzc3Q0UxRTYzMjM2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMCIgc3NlNDE9IjAiIHNzZTQyPSIwIiBhdng9IjAiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4yMjAwMC4xMDAiIHNwPSIiIGFyY2g9Ing2NCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IkRBRFkiIHByb2R1Y3RfbmFtZT0iU3RhbmRhcmQgUEMgKFEzNSArIElDSDksIDIwMDkpIi8-PGV4cCBldGFnPSImcXVvdDtyNDUydDErazJUZ3EvSFh6anZGTkJSaG9wQldSOXNialh4cWVVREg5dVgwPSZxdW90OyIvPjxhcHAgYXBwaWQ9IntGM0M0RkUwMC1FRkQ1LTQwM0ItOTU2OS0zOThBMjBGMUJBNEF9IiB2ZXJzaW9uPSIxLjMuMTUzLjUzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNocm9tZXJlYzM9MjAyMTQ4UiIgaW5zdGFsbGFnZT0iMTE4IiBjb2hvcnQ9InJyZkAwLjA5Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI1NDQ4IiBwaW5nX2ZyZXNobmVzcz0ie0I1MEZCQjk2LTkzMzMtNERCRS1BNzM3LUFCOTBFMUU2OTM0Nn0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjIiIG5leHR2ZXJzaW9uPSI5Ni4wLjEwNTQuMzQiIGxhbmc9IiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBleHBlcmltZW50cz0iY29uc2VudD1mYWxzZSIgbGFzdF9sYXVuY2hfdGltZT0iMTMyODI4NTIzOTczODIyNzYiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE0IiBldmVudHJlc3VsdD0iMCIgZXJyb3Jjb2RlPSItMjE0NzAyMzgzOCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0iZG8iIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzL2UzZTc2NTg3LTA2OTktNDQ4ZS1iZjAzLTU0ZTg5MmEzZmEwMz9QMT0xNjM4OTg0MjE0JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUxQY3BxaU5PRHdpaFlyeXdLY3VWb3RUOFBxcGxxR3hqU29zeWFHNGNuTzVDczhmVUdzYzZReFIlMmIxRCUyYlZ3WVB3czRWSDJzZ2RjWlU1cDE2TDhiN0x6ZyUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjQiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc291cmNlX3VybF9pbmRleD0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvZTNlNzY1ODctMDY5OS00NDhlLWJmMDMtNTRlODkyYTNmYTAzP1AxPTE2Mzg5ODQyMTQmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9TFBjcHFpTk9Ed2loWXJ5d0tjdVZvdFQ4UHFwbHFHeGpTb3N5YUc0Y25PNUNzOGZVR3NjNlF4UiUyYjFEJTJiVndZUHdzNFZIMnNnZGNaVTVwMTZMOGI3THpnJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBkb3dubG9hZGVkPSIxMTI5MjMwMjQiIHRvdGFsPSIxMTI5MjMwMjQiIGRvd25sb2FkX3RpbWVfbXM9IjE2MTQwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHNvdXJjZV91cmxfaW5kZXg9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjE5NjYwOCIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjUyOCIgZG93bmxvYWRfdGltZV9tcz0iMjE5NTQiIGRvd25sb2FkZWQ9IjExMjkyMzAyNCIgdG90YWw9IjExMjkyMzAyNCIgcGFja2FnZV9jYWNoZV9yZXN1bHQ9IjAiIGluc3RhbGxfdGltZV9tcz0iMTE4ODY4Ii8-PHBpbmcgYWN0aXZlPSIwIiByZD0iNTQ0OCIgcGluZ19mcmVzaG5lc3M9InsxRkEyMEY0Qy1DMjJDLTQ1MDAtQTg5Qi05QzI0RkVBQTlFOUZ9Ii8-PC9hcHA-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IjkyLjAuOTAyLjYyIiBuZXh0dmVyc2lvbj0iOTYuMC4xMDU0LjM0IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGNvaG9ydD0icnJmQDAuNDIiIGxhc3RfbGF1bmNoX3RpbWU9IjEzMjcxNzQ1OTE1MDg5NTYyIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjEyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjE1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NjA4IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNTI3IiBkb3dubG9hZGVkPSIxMTI5MjMwMjQiIHRvdGFsPSIxMTI5MjMwMjQiIHBhY2thZ2VfY2FjaGVfcmVzdWx0PSIyIiBpbnN0YWxsX3RpbWVfbXM9IjcyMDciLz48cGluZyBhY3RpdmU9IjAiIHJkPSI1NDQ4IiBwaW5nX2ZyZXNobmVzcz0iezQ1RDQwRDI3LUI3MDgtNDVBOS05REY0LTUzOUVCMkExRkM4N30iLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\elevation_service.exe"
1⤵
PID:3024

C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Installer\setup.exe" --rename-msedge-exe --system-level --verbose-logging --msedge --channel=stable
2⤵
PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Installer\setup.exe" --msedge --channel=stable --delete-old-versions --system-level --verbose-logging
3⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
3⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Control Panel
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- System policy modification
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=96.0.4664.55 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=96.0.1054.34 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcd063a740,0x7ffcd063a750,0x7ffcd063a760
2⤵
PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
2⤵
PID:4708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:8
2⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 /prefetch:3
2⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --mojo-platform-channel-handle=3456 /prefetch:1
2⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --instant-process --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=3476 /prefetch:1
2⤵
PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4848 /prefetch:8
2⤵
PID:3328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --mojo-platform-channel-handle=2768 /prefetch:1
2⤵
PID:2040

C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
2⤵
PID:2792

C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\96.0.1054.34\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:8
2⤵
PID:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --mojo-platform-channel-handle=5160 /prefetch:1
2⤵
PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=entity_extraction --mojo-platform-channel-handle=6176 /prefetch:8
2⤵
PID:72

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5880 /prefetch:8
2⤵
PID:1248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6340 /prefetch:8
2⤵
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --mojo-platform-channel-handle=6496 /prefetch:1
2⤵
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6532 /prefetch:8
2⤵
PID:2404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAANAAAAEAAAAAAAAAABAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6432 /prefetch:2
2⤵
PID:3864

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=1964 /prefetch:1
2⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=6548 /prefetch:1
2⤵
PID:2292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=5576 /prefetch:1
2⤵
PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6584 /prefetch:8
2⤵
PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --disable-client-side-phishing-detection --display-capture-permissions-policy-allowed --field-trial-handle=1928,14783461504516815942,3561284234832663060,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --mojo-platform-channel-handle=5564 /prefetch:1
2⤵
PID:2032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:3500

C:\Windows\system32\werfault.exe
werfault.exe /hc /shared Global\b62821c27179496fa0b0ee14c7d899a3 /t 0 /p 8
1⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: MapViewOfSection
PID:4912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3000

C:\Windows\ImmersiveControlPanel\SystemSettings.exe
"C:\Windows\ImmersiveControlPanel\SystemSettings.exe" -ServerName:microsoft.windows.immersivecontrolpanel
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:4984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:1620

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:5904

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:5616

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3872

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
PID:860

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa397b855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3500

C:\Windows\system32\bootim.exe
bootim.exe /startpage:1
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5092

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery