toxiceye | dada83a7deb7c568532e54bbae01a7da1f5ca57f29918ec821027d3dcf00b49a

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	TelegramRAT.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	rat.exe

Executes dropped EXE 1 IoCs

pid	Process
2676	rat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4160	schtasks.exe
1304	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
1588	timeout.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

Process Discovery

T1057

pid	Process
832	tasklist.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3808065738-1666277613-1125846146-1000\{66F40AB7-66A4-4768-A5AF-D379B3CE408A}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2676	rat.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe
2676	rat.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	TelegramRAT.exe
Token: SeDebugPrivilege	832	tasklist.exe
Token: SeDebugPrivilege	2676	rat.exe
Token: SeDebugPrivilege	2676	rat.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe
1396	helppane.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4944	firefox.exe
4944	firefox.exe
4944	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2676	rat.exe
4944	firefox.exe
1396	helppane.exe
1396	helppane.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 4160	2916	TelegramRAT.exe	92
PID 2916 wrote to memory of 4160	2916	TelegramRAT.exe	92
PID 2916 wrote to memory of 3700	2916	TelegramRAT.exe	94
PID 2916 wrote to memory of 3700	2916	TelegramRAT.exe	94
PID 3700 wrote to memory of 832	3700	cmd.exe	96
PID 3700 wrote to memory of 832	3700	cmd.exe	96
PID 3700 wrote to memory of 4984	3700	cmd.exe	97
PID 3700 wrote to memory of 4984	3700	cmd.exe	97
PID 3700 wrote to memory of 1588	3700	cmd.exe	98
PID 3700 wrote to memory of 1588	3700	cmd.exe	98
PID 3700 wrote to memory of 2676	3700	cmd.exe	99
PID 3700 wrote to memory of 2676	3700	cmd.exe	99
PID 2676 wrote to memory of 1304	2676	rat.exe	101
PID 2676 wrote to memory of 1304	2676	rat.exe	101
PID 2676 wrote to memory of 3068	2676	rat.exe	115
PID 2676 wrote to memory of 3068	2676	rat.exe	115
PID 3068 wrote to memory of 2712	3068	cmd.exe	117
PID 3068 wrote to memory of 2712	3068	cmd.exe	117
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4084 wrote to memory of 4944	4084	firefox.exe	120
PID 4944 wrote to memory of 876	4944	firefox.exe	121
PID 4944 wrote to memory of 876	4944	firefox.exe	121
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122
PID 4944 wrote to memory of 2920	4944	firefox.exe	122

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe
"C:\Users\Admin\AppData\Local\Temp\TelegramRAT.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\System32\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"
  2⤵
  - Creates scheduled task(s)
  PID:4160
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Local\Temp\tmpF4B0.tmp.bat & Del C:\Users\Admin\AppData\Local\Temp\tmpF4B0.tmp.bat
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3700
- - C:\Windows\system32\tasklist.exe
    Tasklist /fi "PID eq 2916"
    3⤵
    - Enumerates processes with tasklist
    - Suspicious use of AdjustPrivilegeToken
    PID:832
- - C:\Windows\system32\find.exe
    find ":"
    3⤵
    PID:4984
- - C:\Windows\system32\timeout.exe
    Timeout /T 1 /Nobreak
    3⤵
    - Delays execution with timeout.exe
    PID:1588
- - C:\Users\Admin\rat.exe
    "rat.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2676
  - - C:\Windows\System32\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "Chrome Update" /tr "C:\Users\Admin\rat.exe"
      4⤵
      Creates scheduled task(s)
      PID:1304
  - - C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /c cmd.exe del C:\
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe del C:\
        5⤵
        
        PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3752 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:5032

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4084
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.0.353996538\1766962065" -parentBuildID 20221007134813 -prefsHandle 1856 -prefMapHandle 1848 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2aa6e175-117b-4118-afdf-225acc05df62} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 1948 186b56f5e58 gpu
    3⤵
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.1.702753281\2014560205" -parentBuildID 20221007134813 -prefsHandle 2304 -prefMapHandle 2300 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2137593-d277-4914-abeb-41e32b444898} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 2348 186b5241b58 socket
    3⤵
    - Checks processor information in registry
    PID:2920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.2.311370692\1853817133" -childID 1 -isForBrowser -prefsHandle 3036 -prefMapHandle 3180 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a13ac2f-c02b-49ba-be18-eb20e6dfce7b} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 3212 186b565ee58 tab
    3⤵
    PID:1452
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.3.1420253414\870916094" -childID 2 -isForBrowser -prefsHandle 3568 -prefMapHandle 3260 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d735e9a-fcbf-4c72-9d15-e76c1b849ed4} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 3532 186a1a65f58 tab
    3⤵
    PID:3720
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4944.4.420799281\1861264785" -childID 3 -isForBrowser -prefsHandle 4148 -prefMapHandle 4144 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1412 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69a028ef-4af8-458d-8e35-a0eab39564c6} 4944 "\\.\pipe\gecko-crash-server-pipe.4944" 4160 186a1a62b58 tab
    3⤵
    PID:560

C:\Windows\helppane.exe
C:\Windows\helppane.exe -Embedding
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument microsoft-edge:https://go.microsoft.com/fwlink/?LinkId=528884
  2⤵
  PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5060 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:5052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --mojo-platform-channel-handle=5764 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5884 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3612

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --mojo-platform-channel-handle=4832 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:3004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=5516 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:1
1⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=4036 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:8
1⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies registry class
PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=122.0.2365.52 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa2d402e98,0x7ffa2d402ea4,0x7ffa2d402eb0
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2260 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:2
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=2296 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:3
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=2444 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2264,i,182425650604301845,1324665153004943507,262144 --variations-seed-version /prefetch:8
  2⤵
  PID:3780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

System Information Discovery