477edafe7eb5ecfa2c567d373939eef1f57af73bbd4f322a676cc4490717e729

System Information Discovery

Processes:

python-3.12.3-amd64.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	python-3.12.3-amd64.exe

Executes dropped EXE 64 IoCs

Processes:

selenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeAccGenerator.exeAccGenerator.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeAccGenerator.exeAccGenerator.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exeselenium-manager.exemsedgedriver.exepython-3.12.3-amd64.exepython-3.12.3-amd64.exepython-3.12.3-amd64.exepython.exepython.exepy.exepython.exepy.exepython.exepy.exepython.exepythonw.exepythonw.exepythonw.exe

pid	process
4028	selenium-manager.exe
1536	msedgedriver.exe
5780	selenium-manager.exe
5536	msedgedriver.exe
5368	selenium-manager.exe
4384	msedgedriver.exe
3032	selenium-manager.exe
556	msedgedriver.exe
3168	selenium-manager.exe
3684	msedgedriver.exe
6072	AccGenerator.exe
6016	AccGenerator.exe
2600	selenium-manager.exe
5332	msedgedriver.exe
4508	selenium-manager.exe
5844	msedgedriver.exe
6092	selenium-manager.exe
5272	msedgedriver.exe
5060	selenium-manager.exe
3876	msedgedriver.exe
5548	AccGenerator.exe
4232	AccGenerator.exe
4516	selenium-manager.exe
1428	msedgedriver.exe
3300	selenium-manager.exe
4360	msedgedriver.exe
1116	selenium-manager.exe
2488	msedgedriver.exe
1432	selenium-manager.exe
3844	msedgedriver.exe
5600	selenium-manager.exe
4024	msedgedriver.exe
3816	selenium-manager.exe
2828	msedgedriver.exe
4436	selenium-manager.exe
4456	msedgedriver.exe
2488	selenium-manager.exe
4028	msedgedriver.exe
6008	selenium-manager.exe
3308	msedgedriver.exe
6592	selenium-manager.exe
6792	msedgedriver.exe
6716	selenium-manager.exe
4252	msedgedriver.exe
6228	selenium-manager.exe
5724	msedgedriver.exe
6388	selenium-manager.exe
1804	msedgedriver.exe
6636	selenium-manager.exe
5364	msedgedriver.exe
1608	python-3.12.3-amd64.exe
4368	python-3.12.3-amd64.exe
4588	python-3.12.3-amd64.exe
5852	python.exe
6348	python.exe
5324	py.exe
4424	python.exe
7004	py.exe
3560	python.exe
5456	py.exe
6848	python.exe
6036	pythonw.exe
5952	pythonw.exe
6812	pythonw.exe

Loads dropped DLL 64 IoCs

Processes:

AccGenerator.exeAccGenerator.exeAccGenerator.exepython-3.12.3-amd64.exeMsiExec.exepython.exepython.exe

pid	process
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
4012	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
6016	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4232	AccGenerator.exe
4368	python-3.12.3-amd64.exe
5112	MsiExec.exe
5852	python.exe
5852	python.exe
5852	python.exe
5852	python.exe
5852	python.exe
5852	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe
6348	python.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

msiexec.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

python-3.12.3-amd64.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}\\python-3.12.3-amd64.exe\" /burn.runonce"	python-3.12.3-amd64.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

1159 2904 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

flow	pid	process
1159	2904	msiexec.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs

Web Service

T1102

Processes:

flow	ioc
457	raw.githubusercontent.com
458	raw.githubusercontent.com
102	raw.githubusercontent.com
103	raw.githubusercontent.com
107	raw.githubusercontent.com
325	raw.githubusercontent.com
326	raw.githubusercontent.com

Drops file in System32 directory 36 IoCs

Processes:

msedgedriver.exemsedgedriver.exemsedgedriver.exemsedgedriver.exe

description	ioc	process
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\exe\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\DLL\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\msedgedriver.exe.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\symbols\dll\ntdll.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\kernel32.pdb	msedgedriver.exe
File opened for modification	C:\Windows\System32\exe\msedgedriver.exe.pdb	msedgedriver.exe

Drops file in Windows directory 54 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}	msiexec.exe
File created	C:\Windows\Installer\e626435.msi	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e626422.msi	msiexec.exe
File created	C:\Windows\Installer\e62642b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e626436.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{837260D6-3959-452B-A557-666302BEA663}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}	msiexec.exe
File created	C:\Windows\Installer\e62641d.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{575FEF7A-71FE-437E-91B0-D3838C1026DA}	msiexec.exe
File opened for modification	C:\Windows\Installer\e626431.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI66E2.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{52ABF617-F7B4-40F9-8197-C7490DAA97A3}	msiexec.exe
File created	C:\Windows\Installer\e62641c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6D2E.tmp	msiexec.exe
File created	C:\Windows\Installer\e626436.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e626418.msi	msiexec.exe
File created	C:\Windows\Installer\e626427.msi	msiexec.exe
File created	C:\Windows\Installer\e62642c.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A2FC8FF0-021A-431C-826E-E4B85D3F064F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBC2C.tmp	msiexec.exe
File created	C:\Windows\Installer\e62643b.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	msiexec.exe
File created	C:\Windows\Installer\e626430.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAB24.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e62643b.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	msiexec.exe
File created	C:\Windows\Installer\e626422.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e62642c.msi	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID7B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI67BE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7964.tmp	msiexec.exe
File created	C:\Windows\Installer\e626431.msi	msiexec.exe
File created	C:\Windows\Installer\e626421.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8AE9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6EA.tmp	msiexec.exe
File created	C:\Windows\Installer\e62643f.msi	msiexec.exe
File created	C:\Windows\Installer\e626426.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}	msiexec.exe
File opened for modification	C:\Windows\Installer\e626413.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e62641d.msi	msiexec.exe
File created	C:\Windows\Installer\e62643a.msi	msiexec.exe
File created	C:\Windows\Installer\e626413.msi	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID40B.tmp	msiexec.exe
File created	C:\Windows\Installer\e626417.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e626418.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e626427.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\ARPIcon	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000081a0e6b9f9d406b40000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000081a0e6b90000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff00000000070001000068090081a0e6b9000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d81a0e6b9000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000081a0e6b900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exechrome.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

chrome.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133607817056108901"	chrome.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe

Modifies registry class 64 IoCs

Processes:

msedge.exemsedge.exemsiexec.exemsedge.exepython-3.12.3-amd64.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile\shell\open	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyc\ = "Python.CompiledFile"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyz\ = "Python.ArchiveFile"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\CPython-3.12\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{5C195EDE-CE8F-4C5C-A4B8-B60913B9C2B9}\Dependents	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.py	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\SourceList\PackageName = "launcher.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\CPython-3.12\DisplayName = "Python 3.12.3 (64-bit)"	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}\ = "{8EB1F259-1326-4583-B383-F5C3D7C93D7D}"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Python.NoConFile	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shellex	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\PackageCode = "3EC6A7E73B1FB704F9E61374AB620D2E"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyw\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\DisplayName = "Python 3.12.3 Standard Library (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shell\open\command	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Python.File\Shell\editwithidle\shell\edit312\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Programs\\Python\\Python312\\pythonw.exe\" -m idlelib \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\Content Type = "application/x-zip-compressed"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\716FBA254B7F9F0418797C94D0AA793A\ProductIcon = "C:\\Windows\\Installer\\{52ABF617-F7B4-40F9-8197-C7490DAA97A3}\\ARPIcon"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConArchiveFile\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{A1839EB2-3C30-4BCD-AACF-04F6FF6C90CD}\Dependents	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyw	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.NoConFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.Extension\DefaultIcon\ = "\"C:\\Windows\\py.exe\",3"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Python.File\Shell\editwithidle\shell	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Python.File\Shell\editwithidle\Subcommands	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}	python-3.12.3-amd64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{837260D6-3959-452B-A557-666302BEA663}\DisplayName = "Python 3.12.3 pip Bootstrap (64-bit)"	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{3519C7D0-70D4-46F5-A0A9-3A115D73E2EC}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.File	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\716FBA254B7F9F0418797C94D0AA793A\AssociateFiles	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shellex\DropHandler	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConArchiveFile\shellex\DropHandler\ = "{BEA218D2-6950-497B-9434-61683EC065FE}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{474E5879-A9D5-4DF5-9385-ADF7E224CEC7}\Dependents\{5ee4d2b6-a5dc-4321-b6bd-3ebc98120a51}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{8EB1F259-1326-4583-B383-F5C3D7C93D7D}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{575FEF7A-71FE-437E-91B0-D3838C1026DA}	python-3.12.3-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000_Classes\Installer\Dependencies\{A2FC8FF0-021A-431C-826E-E4B85D3F064F}\Dependents	python-3.12.3-amd64.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exechrome.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeidentity_helper.exe

pid	process
4676	chrome.exe
4676	chrome.exe
4208	msedge.exe
4208	msedge.exe
2736	msedge.exe
2736	msedge.exe
5212	identity_helper.exe
5212	identity_helper.exe
4632	msedge.exe
4632	msedge.exe
5516	msedge.exe
5516	msedge.exe
5408	identity_helper.exe
5408	identity_helper.exe
1092	msedge.exe
1092	msedge.exe
3236	msedge.exe
3236	msedge.exe
2552	identity_helper.exe
2552	identity_helper.exe
4636	chrome.exe
4636	chrome.exe
5472	msedge.exe
5472	msedge.exe
4084	msedge.exe
4084	msedge.exe
5536	identity_helper.exe
5536	identity_helper.exe
4000	msedge.exe
4000	msedge.exe
5064	msedge.exe
5064	msedge.exe
6008	identity_helper.exe
6008	identity_helper.exe
3316	msedge.exe
3316	msedge.exe
5368	msedge.exe
5368	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe
5624	msedge.exe
5624	msedge.exe
3168	msedge.exe
3168	msedge.exe
5660	identity_helper.exe
5660	identity_helper.exe
920	msedge.exe
920	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
428	identity_helper.exe
428	identity_helper.exe
2276	msedge.exe
2276	msedge.exe
1128	msedge.exe
1128	msedge.exe
5336	identity_helper.exe
5336	identity_helper.exe
4536	msedge.exe
4536	msedge.exe
1916	msedge.exe
1916	msedge.exe
5184	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

Processes:

chrome.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
2736	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
5516	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
5064	msedge.exe
5064	msedge.exe
5064	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
5368	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe
Token: SeShutdownPrivilege	4676	chrome.exe
Token: SeCreatePagefilePrivilege	4676	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exemsedge.exemsedge.exemsedge.exemsedge.exe7zG.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exe

pid	process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
2736	msedge.exe
2736	msedge.exe
5516	msedge.exe
5516	msedge.exe
1092	msedge.exe
1092	msedge.exe
4084	msedge.exe
4084	msedge.exe
6104	7zG.exe
5064	msedge.exe
5064	msedge.exe
5368	msedge.exe
5368	msedge.exe
3168	msedge.exe
3168	msedge.exe
4800	msedge.exe
4800	msedge.exe
1128	msedge.exe
1128	msedge.exe
1916	msedge.exe
1916	msedge.exe
5212	msedge.exe
5212	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

Processes:

chrome.exe

pid	process
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe
4676	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

4004 OpenWith.exe

pid	process
4004	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 4676 wrote to memory of 3320	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 3320	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 2616	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 4668	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 4668	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe
PID 4676 wrote to memory of 368	4676	chrome.exe	chrome.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\glif-controlnet-any-word-roblox-0ee6446645-f2kf6kdc5k8rvqt55wwl7jiq.jpg
1⤵
PID:2460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb222cab58,0x7ffb222cab68,0x7ffb222cab78
2⤵
PID:3320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:2
2⤵
PID:2616

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:4668

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:1020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3124 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:4900

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4052 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:1652

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4544 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:4936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4560 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:2588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:4220

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:3288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4740 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4576 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:4784

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5000 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:2224

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3176 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:3700

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3232 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:5040

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3236 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:2380

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4636

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:2844

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:7052

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5052 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:6460

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=3168 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:6744

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5240 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:428

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5272 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:3368

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=2468 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:6468

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=4676 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:6936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5756 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:1
2⤵
PID:4408

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2772 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:5720

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5616 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:5072

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:836

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6096 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:6304

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2772 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:5576

C:\Users\Admin\Downloads\python-3.12.3-amd64.exe
"C:\Users\Admin\Downloads\python-3.12.3-amd64.exe"
2⤵
- Executes dropped EXE
PID:1608

C:\Windows\Temp\{3DBABD90-BF42-4E76-BFA0-37CB801DAF70}\.cr\python-3.12.3-amd64.exe
"C:\Windows\Temp\{3DBABD90-BF42-4E76-BFA0-37CB801DAF70}\.cr\python-3.12.3-amd64.exe" -burn.clean.room="C:\Users\Admin\Downloads\python-3.12.3-amd64.exe" -burn.filehandle.attached=532 -burn.filehandle.self=540
3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies registry class
PID:4368

C:\Windows\Temp\{4E7F05CD-A1ED-4A2E-A479-A4CC12B9D687}\.be\python-3.12.3-amd64.exe
"C:\Windows\Temp\{4E7F05CD-A1ED-4A2E-A479-A4CC12B9D687}\.be\python-3.12.3-amd64.exe" -q -burn.elevated BurnPipe.{A83FC62D-761C-439A-AE5D-62DCE0828710} {E8B9B6A4-BC74-42AB-8EC4-70E771DAE890} 4368
4⤵
- Executes dropped EXE
PID:4588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5904 --field-trial-handle=1912,i,4327281349147750282,13368686319563224701,131072 /prefetch:8
2⤵
PID:6704

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:4344

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:212

C:\Users\Admin\AppData\Local\Temp\Temp1_AccGenerator.zip\AccGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_AccGenerator.zip\AccGenerator.exe"
1⤵
PID:3752

C:\Users\Admin\AppData\Local\Temp\Temp1_AccGenerator.zip\AccGenerator.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_AccGenerator.zip\AccGenerator.exe"
2⤵
- Loads dropped DLL
PID:4012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:64

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3528

C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:4028

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:1348

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:2552

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:4916

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5092

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:1724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:2260

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=59469
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" data:,
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2044 /prefetch:2
5⤵
PID:4304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --enable-logging --log-level=0 --mojo-platform-channel-handle=2156 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --enable-logging --log-level=0 --mojo-platform-channel-handle=2760 /prefetch:8
5⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
5⤵
PID:1140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
5⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
5⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --enable-logging --log-level=0 --mojo-platform-channel-handle=5644 /prefetch:8
5⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --enable-logging --log-level=0 --mojo-platform-channel-handle=5644 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4448 /prefetch:1
5⤵
PID:5456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
5⤵
PID:5428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
5⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2032,747120001061944577,5444249548766066817,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1536_873428506" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
5⤵
PID:5144

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3428

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5400

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5896

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5764

C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:5780

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:5840

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:5880

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5348

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5364

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5484

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=50991
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" data:,
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:5552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2240 /prefetch:2
5⤵
PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --enable-logging --log-level=0 --mojo-platform-channel-handle=2292 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --enable-logging --log-level=0 --mojo-platform-channel-handle=2936 /prefetch:8
5⤵
PID:4256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
5⤵
PID:1648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
5⤵
PID:3572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
5⤵
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --enable-logging --log-level=0 --mojo-platform-channel-handle=5824 /prefetch:8
5⤵
PID:5788

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --enable-logging --log-level=0 --mojo-platform-channel-handle=5824 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
5⤵
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4272 /prefetch:1
5⤵
PID:808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
5⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2212,13995743377166686418,8188867341780815266,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5536_1565762455" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
5⤵
PID:5968

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5840

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2244

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4292

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4852

C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:5368

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:5760

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:4888

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:6124

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:6092

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5712

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=61321
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:4384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" data:,
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2136 /prefetch:2
5⤵
PID:4792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --enable-logging --log-level=0 --mojo-platform-channel-handle=2300 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --enable-logging --log-level=0 --mojo-platform-channel-handle=2720 /prefetch:8
5⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
5⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
5⤵
PID:5192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
5⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --enable-logging --log-level=0 --mojo-platform-channel-handle=5892 /prefetch:8
5⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --enable-logging --log-level=0 --mojo-platform-channel-handle=5892 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
5⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
5⤵
PID:5416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
5⤵
PID:5512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2120,5216174145423115999,8834438237210134930,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4384_913608999" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
5⤵
PID:5464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3032

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5716

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4528

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4520

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4688

C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:3032

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:2948

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:5200

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5400

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5184

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:4584

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=58107
3⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:1456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2116 /prefetch:2
5⤵
PID:4300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --enable-logging --log-level=0 --mojo-platform-channel-handle=2296 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --enable-logging --log-level=0 --mojo-platform-channel-handle=2824 /prefetch:8
5⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
5⤵
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
5⤵
PID:5804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
5⤵
PID:3488

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --enable-logging --log-level=0 --mojo-platform-channel-handle=3636 /prefetch:8
5⤵
PID:5096

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --enable-logging --log-level=0 --mojo-platform-channel-handle=3636 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
5⤵
PID:5360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
5⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
5⤵
PID:5136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2104,7786006343189778160,517652784290212040,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir556_307656513" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
5⤵
PID:6004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1712

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1168

C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI37522\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:3168

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:4852

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:2232

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:180

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:1900

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:3428

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=58679
3⤵
- Executes dropped EXE
PID:3684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\AccGenerator\" -spe -an -ai#7zMap30246:86:7zEvent10447
1⤵
- Suspicious use of FindShellTrayWindow
PID:6104

C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe
"C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe"
1⤵
- Executes dropped EXE
PID:6072

C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe
"C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6016

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5432

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2348

C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:2600

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:224

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5872

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5436

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5828

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:5232

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=58737
3⤵
- Executes dropped EXE
PID:5332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" data:,
4⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:5036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2232 /prefetch:2
5⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --enable-logging --log-level=0 --mojo-platform-channel-handle=2284 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --enable-logging --log-level=0 --mojo-platform-channel-handle=2952 /prefetch:8
5⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
5⤵
PID:4164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
5⤵
PID:5988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4808 /prefetch:1
5⤵
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --enable-logging --log-level=0 --mojo-platform-channel-handle=5648 /prefetch:8
5⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,13899680826340277721,6467147572797521458,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5332_755214643" --enable-logging --log-level=0 --mojo-platform-channel-handle=5648 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:6008

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5188

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3384

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2344

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5060

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5640

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5444

C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:4508

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:2180

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:1768

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5152

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:944

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5632

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=59860
3⤵
- Executes dropped EXE
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2168 /prefetch:2
5⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --enable-logging --log-level=0 --mojo-platform-channel-handle=2412 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --enable-logging --log-level=0 --mojo-platform-channel-handle=2840 /prefetch:8
5⤵
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
5⤵
PID:5704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
5⤵
PID:3096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
5⤵
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --enable-logging --log-level=0 --mojo-platform-channel-handle=4432 /prefetch:8
5⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --enable-logging --log-level=0 --mojo-platform-channel-handle=4432 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
5⤵
PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
5⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
5⤵
PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,1797860608562334929,6959746918869180877,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5844_802709857" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
5⤵
PID:2300

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5272

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1200

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1308

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:836

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4508

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5436

C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6092

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:5676

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:4684

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5324

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:3092

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:1100

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=55524
3⤵
- Executes dropped EXE
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:3428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2168 /prefetch:2
5⤵
PID:2632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --enable-logging --log-level=0 --mojo-platform-channel-handle=2440 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --enable-logging --log-level=0 --mojo-platform-channel-handle=2920 /prefetch:8
5⤵
PID:5640

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
5⤵
PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
5⤵
PID:1552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
5⤵
PID:3264

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --enable-logging --log-level=0 --mojo-platform-channel-handle=5628 /prefetch:8
5⤵
PID:5972

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --enable-logging --log-level=0 --mojo-platform-channel-handle=5628 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
5⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
5⤵
PID:5020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
5⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2160,6726605926857670225,17403838676468872627,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5272_416098456" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
5⤵
PID:6092

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5600

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1700

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4804

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4916

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4124

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5248

C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI60722\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:5060

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:2000

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:5012

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:116

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5052

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5920

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=55508
3⤵
- Executes dropped EXE
PID:3876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:848

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5600

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5188

C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe
"C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe"
1⤵
- Executes dropped EXE
PID:5548

C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe
"C:\Users\Admin\Downloads\AccGenerator\AccGenerator.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4232

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3000

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6056

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:4516

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:3228

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:5252

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5608

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:4180

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "ver"
3⤵
PID:4464

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=55560
3⤵
- Executes dropped EXE
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:4800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2080 /prefetch:2
5⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --enable-logging --log-level=0 --mojo-platform-channel-handle=2484 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --enable-logging --log-level=0 --mojo-platform-channel-handle=2832 /prefetch:8
5⤵
PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
5⤵
PID:1704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
5⤵
PID:5032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
5⤵
PID:1876

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --enable-logging --log-level=0 --mojo-platform-channel-handle=5716 /prefetch:8
5⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --enable-logging --log-level=0 --mojo-platform-channel-handle=5716 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
5⤵
PID:5800

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3692 /prefetch:1
5⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
5⤵
PID:6048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2056,8024643289140333166,6562966597090064545,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1428_1528013338" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
5⤵
PID:3752

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5196

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6136

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4068

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5252

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4628

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5340

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:3300

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:5912

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:1584

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5796

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:2844

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:2120

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=63834
3⤵
- Executes dropped EXE
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2208 /prefetch:2
5⤵
PID:5488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --enable-logging --log-level=0 --mojo-platform-channel-handle=2276 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --enable-logging --log-level=0 --mojo-platform-channel-handle=2960 /prefetch:8
5⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
5⤵
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
5⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
5⤵
PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --enable-logging --log-level=0 --mojo-platform-channel-handle=5620 /prefetch:8
5⤵
PID:5404

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --enable-logging --log-level=0 --mojo-platform-channel-handle=5620 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3652 /prefetch:1
5⤵
PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
5⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
5⤵
PID:3384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2196,16988464090717109389,18055804845099570323,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4360_1685128262" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
5⤵
PID:5024

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1580

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6080

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3368

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:1116

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:2052

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:4136

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:876

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:6128

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5972

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=62640
3⤵
- Executes dropped EXE
PID:2488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2212 /prefetch:2
5⤵
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --enable-logging --log-level=0 --mojo-platform-channel-handle=2264 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --enable-logging --log-level=0 --mojo-platform-channel-handle=2836 /prefetch:8
5⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
5⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
5⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
5⤵
PID:5352

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --enable-logging --log-level=0 --mojo-platform-channel-handle=5656 /prefetch:8
5⤵
PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --enable-logging --log-level=0 --mojo-platform-channel-handle=5656 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2480 /prefetch:1
5⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
5⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
5⤵
PID:5976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2200,11548668983859065575,15264539420719994784,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_1736230773" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
5⤵
PID:5028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2800

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5212

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4280

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1988

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2004

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4316

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:1432

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:724

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:2348

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:1584

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5884

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:4908

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=50930
3⤵
- Executes dropped EXE
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" data:,
4⤵
- Enumerates system info in registry
- Suspicious use of FindShellTrayWindow
PID:5212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2244 /prefetch:2
5⤵
PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --enable-logging --log-level=0 --mojo-platform-channel-handle=2296 /prefetch:3
5⤵
PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --enable-logging --log-level=0 --mojo-platform-channel-handle=2804 /prefetch:8
5⤵
PID:5248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
5⤵
PID:4068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
5⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
5⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --enable-logging --log-level=0 --mojo-platform-channel-handle=4132 /prefetch:8
5⤵
PID:5480

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --enable-logging --log-level=0 --mojo-platform-channel-handle=4132 /prefetch:8
5⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
5⤵
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
5⤵
PID:4980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
5⤵
PID:5232

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2220,9847718999134954231,12932240802068689767,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3844_1463888011" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
5⤵
PID:5184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5140

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4180

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1796

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5920

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:516

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:5600

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:3816

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:4916

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5876

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:5908

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5052

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=52281
3⤵
- Executes dropped EXE
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:5844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2160 /prefetch:2
5⤵
PID:4808

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --enable-logging --log-level=0 --mojo-platform-channel-handle=2232 /prefetch:3
5⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --enable-logging --log-level=0 --mojo-platform-channel-handle=2756 /prefetch:8
5⤵
PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
5⤵
PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
5⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
5⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --enable-logging --log-level=0 --mojo-platform-channel-handle=5824 /prefetch:8
5⤵
PID:2920

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --enable-logging --log-level=0 --mojo-platform-channel-handle=5824 /prefetch:8
5⤵
PID:1860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
5⤵
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=184 /prefetch:1
5⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
5⤵
PID:1968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2148,7630076703780222676,1145995045751650278,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4024_1740111351" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
5⤵
PID:5944

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4048

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5888

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3688

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1476

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4992

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:456

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:448

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1544

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:3816

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:6052

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:3756

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:4992

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:4868

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5616

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=56458
3⤵
- Executes dropped EXE
PID:2828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" data:,
4⤵
- Enumerates system info in registry
PID:448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2168 /prefetch:2
5⤵
PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --enable-logging --log-level=0 --mojo-platform-channel-handle=2512 /prefetch:3
5⤵
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --enable-logging --log-level=0 --mojo-platform-channel-handle=2988 /prefetch:8
5⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
5⤵
PID:1148

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
5⤵
PID:3192

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
5⤵
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --enable-logging --log-level=0 --mojo-platform-channel-handle=5512 /prefetch:8
5⤵
PID:2516

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --enable-logging --log-level=0 --mojo-platform-channel-handle=5512 /prefetch:8
5⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
5⤵
PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
5⤵
PID:5532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
5⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2152,4341325418421779718,13393235201910184088,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir2828_404650738" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4836 /prefetch:1
5⤵
PID:5544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3556

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3540

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1764

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5216

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5156

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5720

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5756

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5824

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:4436

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:4964

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:428

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5332

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:4348

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:1188

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=52786
3⤵
- Executes dropped EXE
PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" data:,
4⤵
- Enumerates system info in registry
PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2172 /prefetch:2
5⤵
PID:4688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --enable-logging --log-level=0 --mojo-platform-channel-handle=2248 /prefetch:3
5⤵
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3036 /prefetch:1
5⤵
PID:6016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3060 /prefetch:1
5⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --enable-logging --log-level=0 --mojo-platform-channel-handle=3236 /prefetch:8
5⤵
PID:2328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
5⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --enable-logging --log-level=0 --mojo-platform-channel-handle=5548 /prefetch:8
5⤵
PID:2068

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --enable-logging --log-level=0 --mojo-platform-channel-handle=5548 /prefetch:8
5⤵
PID:456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
5⤵
PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
5⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
5⤵
PID:1428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2140,599416309803891980,3273474855304065196,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4456_1218776098" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4344 /prefetch:1
5⤵
PID:6056

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5444

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1524

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5152

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5848

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1316

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3116

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:2488

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:2376

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:1116

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:3556

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:640

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5532

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=55397
3⤵
- Executes dropped EXE
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" data:,
4⤵
- Enumerates system info in registry
PID:1872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:5868

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2084 /prefetch:2
5⤵
PID:388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --enable-logging --log-level=0 --mojo-platform-channel-handle=2260 /prefetch:3
5⤵
PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --enable-logging --log-level=0 --mojo-platform-channel-handle=2812 /prefetch:8
5⤵
PID:1088

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
5⤵
PID:1132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
5⤵
PID:5172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
5⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --enable-logging --log-level=0 --mojo-platform-channel-handle=5632 /prefetch:8
5⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,14118944782434879247,17329825304589945218,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4028_1717085125" --enable-logging --log-level=0 --mojo-platform-channel-handle=5632 /prefetch:8
5⤵
PID:3880

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5900

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4604

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3412

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1352

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1808

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3908

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6008

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:5196

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:5352

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5172

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:5452

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=49661
3⤵
- Executes dropped EXE
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" data:,
4⤵
- Enumerates system info in registry
PID:4124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:3892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2176 /prefetch:2
5⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --enable-logging --log-level=0 --mojo-platform-channel-handle=2244 /prefetch:3
5⤵
PID:5388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --enable-logging --log-level=0 --mojo-platform-channel-handle=2916 /prefetch:8
5⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
5⤵
PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
5⤵
PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
5⤵
PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --enable-logging --log-level=0 --mojo-platform-channel-handle=5472 /prefetch:8
5⤵
PID:2776

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --enable-logging --log-level=0 --mojo-platform-channel-handle=5472 /prefetch:8
5⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
5⤵
PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
5⤵
PID:5156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
5⤵
PID:6008

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2164,14983267060685753815,6927379824814534719,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir3308_1225059319" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
5⤵
PID:3964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3512

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2552

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4980

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3816

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6296

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6312

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6336

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6560

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6576

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6592

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:6616

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:6632

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:6680

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:6696

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:6772

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=53802
3⤵
- Executes dropped EXE
PID:6792

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" data:,
4⤵
- Enumerates system info in registry
PID:6844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:6860

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2196 /prefetch:2
5⤵
PID:7116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --enable-logging --log-level=0 --mojo-platform-channel-handle=2272 /prefetch:3
5⤵
PID:7124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3068 /prefetch:1
5⤵
PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3088 /prefetch:1
5⤵
PID:6172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --enable-logging --log-level=0 --mojo-platform-channel-handle=3420 /prefetch:8
5⤵
PID:6176

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
5⤵
PID:3688

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --enable-logging --log-level=0 --mojo-platform-channel-handle=5844 /prefetch:8
5⤵
PID:6288

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --enable-logging --log-level=0 --mojo-platform-channel-handle=5844 /prefetch:8
5⤵
PID:6388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
5⤵
PID:6508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
5⤵
PID:6516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
5⤵
PID:5888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2176,2344062904312010743,10230115787980694591,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir6792_989360694" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
5⤵
PID:5012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:7164

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1812

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:404

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:976

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5380

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4368

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5636

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5564

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2148

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6584

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6724

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6716

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:6684

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:6764

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:6840

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:6896

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:7152

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=58090
3⤵
- Executes dropped EXE
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" data:,
4⤵
- Enumerates system info in registry
PID:5244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2132 /prefetch:2
5⤵
PID:6356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --enable-logging --log-level=0 --mojo-platform-channel-handle=2336 /prefetch:3
5⤵
PID:4564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --enable-logging --log-level=0 --mojo-platform-channel-handle=3044 /prefetch:8
5⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
5⤵
PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
5⤵
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
5⤵
PID:6140

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --enable-logging --log-level=0 --mojo-platform-channel-handle=5864 /prefetch:8
5⤵
PID:2844

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,866642970718772602,3030761298143217625,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir4252_927390916" --enable-logging --log-level=0 --mojo-platform-channel-handle=5864 /prefetch:8
5⤵
PID:6108

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6064

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6932

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:7040

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4972

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1304

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2120

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6488

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:736

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6224

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6228

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:5604

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:4740

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:5456

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:2972

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:3412

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=52890
3⤵
- Executes dropped EXE
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2180 /prefetch:2
5⤵
PID:6840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --enable-logging --log-level=0 --mojo-platform-channel-handle=2236 /prefetch:3
5⤵
PID:7108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --enable-logging --log-level=0 --mojo-platform-channel-handle=2908 /prefetch:8
5⤵
PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
5⤵
PID:7072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
5⤵
PID:7160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
5⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --enable-logging --log-level=0 --mojo-platform-channel-handle=5844 /prefetch:8
5⤵
PID:6324

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --enable-logging --log-level=0 --mojo-platform-channel-handle=5844 /prefetch:8
5⤵
PID:5396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:1
5⤵
PID:6508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4368 /prefetch:1
5⤵
PID:5504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
5⤵
PID:6984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2168,11774026134902911581,16317982222350938154,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5724_643773141" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6056 /prefetch:1
5⤵
PID:6996

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3096

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5416

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6568

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:7044

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3116

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:464

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5864

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6872

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4740

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5748

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6388

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:2972

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:2480

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:6228

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:6420

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:6948

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=53376
3⤵
- Executes dropped EXE
PID:1804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" data:,
4⤵
- Enumerates system info in registry
PID:5984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2168 /prefetch:2
5⤵
PID:3116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --enable-logging --log-level=0 --mojo-platform-channel-handle=2228 /prefetch:3
5⤵
PID:4648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --enable-logging --log-level=0 --mojo-platform-channel-handle=2944 /prefetch:8
5⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
5⤵
PID:6320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
5⤵
PID:6728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
5⤵
PID:6368

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --enable-logging --log-level=0 --mojo-platform-channel-handle=5616 /prefetch:8
5⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --enable-logging --log-level=0 --mojo-platform-channel-handle=5616 /prefetch:8
5⤵
PID:6932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
5⤵
PID:6100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
5⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
5⤵
PID:6236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2144,7970634979629799203,10325412623923822759,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir1804_192168292" --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
5⤵
PID:4856

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4396

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6868

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6632

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6760

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:7012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6728

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4964

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2724

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:4588

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1544

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6460

C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe
C:\Users\Admin\AppData\Local\Temp\_MEI55482\selenium\webdriver\common\windows\selenium-manager.exe --browser MicrosoftEdge --output json
3⤵
- Executes dropped EXE
PID:6636

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "wmic os get osarchitecture"
4⤵
PID:6024

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic os get osarchitecture
5⤵
PID:5140

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "set PFILES=%PROGRAMFILES(X86)%&& wmic datafile where name='!PFILES:\=\\!\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value"
4⤵
PID:6660

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic datafile where name='C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.exe' get Version /value
5⤵
PID:6108

C:\Windows\SysWOW64\cmd.exe
"cmd" /v/c "msedgedriver --version"
4⤵
PID:6716

C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe
C:\Users\Admin\.cache\selenium\msedgedriver\win64\92.0.902.84\msedgedriver.exe --port=59792
3⤵
- Executes dropped EXE
PID:5364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --allow-pre-commit-input --disable-background-networking --disable-backgrounding-occluded-windows --disable-client-side-phishing-detection --disable-default-apps --disable-hang-monitor --disable-popup-blocking --disable-prompt-on-repost --disable-sync --enable-automation --enable-blink-features=ShadowDOMV0 --enable-logging --log-level=0 --no-first-run --no-service-autorun --password-store=basic --remote-debugging-port=0 --test-type=webdriver --use-mock-keychain --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" data:,
4⤵
- Enumerates system info in registry
- Modifies registry class
PID:6820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891 /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891 --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb1e6046f8,0x7ffb1e604708,0x7ffb1e604718
5⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --enable-logging --log-level=0 --mojo-platform-channel-handle=2200 /prefetch:2
5⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --enable-logging --log-level=0 --mojo-platform-channel-handle=2256 /prefetch:3
5⤵
PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --lang=en-US --service-sandbox-type=utility --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --enable-logging --log-level=0 --mojo-platform-channel-handle=2872 /prefetch:8
5⤵
PID:4048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
5⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
5⤵
PID:1188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-automation --enable-logging --log-level=0 --remote-debugging-port=0 --test-type=webdriver --allow-pre-commit-input --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --enable-blink-features=ShadowDOMV0 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
5⤵
PID:2184

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --enable-logging --log-level=0 --mojo-platform-channel-handle=4476 /prefetch:8
5⤵
PID:5884

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --enable-logging --log-level=0 --mojo-platform-channel-handle=4476 /prefetch:8
5⤵
PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,6358734558799858295,3826307342537214891,131072 --lang=en-US --service-sandbox-type=none --enable-logging --log-level=0 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\scoped_dir5364_251470891" --enable-logging --log-level=0 --mojo-platform-channel-handle=2844 /prefetch:3
5⤵
PID:6784

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3036

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:3028

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:5696

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6852

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:1012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2480

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6484

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:6924

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c cls
3⤵
PID:2256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1492

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:628

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6288

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5824

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:1700

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2904

C:\Windows\syswow64\MsiExec.exe
C:\Windows\syswow64\MsiExec.exe -Embedding FC04FEA90005F8E64EDED667B7FC9EF6
2⤵
- Loads dropped DLL
PID:5112

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe" -E -s -m ensurepip -U --default-pip
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5852

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp78nheu5r\\pip-24.0-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmp78nheu5r', '--upgrade', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6348

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\roblox-account-creator-main\" -spe -an -ai#7zMap28200:116:7zEvent9765
1⤵
PID:4772

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
- Executes dropped EXE
PID:5324

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
- Executes dropped EXE
PID:4424

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
- Executes dropped EXE
PID:7004

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
- Executes dropped EXE
PID:3560

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
- Executes dropped EXE
PID:5456

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
- Executes dropped EXE
PID:6848

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4004

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
"C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe" -m idlelib "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
- Executes dropped EXE
PID:6036

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55203
2⤵
- Executes dropped EXE
PID:5952

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55203
2⤵
- Executes dropped EXE
PID:6812

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55214
2⤵
PID:868

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55214
2⤵
PID:4184

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55225
2⤵
PID:3292

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55233
2⤵
PID:1476

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55241
2⤵
PID:6364

C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\pythonw.exe -c __import__('idlelib.run').run.main(True) 55249
2⤵
PID:6732

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:3560

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:4440

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:3512

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:1616

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:6544

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:1996

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:5196

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:1020

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:5764

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:1352

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:5912

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:6940

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:4520

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:5896

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:2844

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:6152

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:5256

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:3500

C:\Windows\py.exe
"C:\Windows\py.exe" "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
1⤵
PID:2628

C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe
C:\Users\Admin\AppData\Local\Programs\Python\Python312\python.exe "C:\Users\Admin\Downloads\roblox-account-creator-main\create.py"
2⤵
PID:6632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery