1859522309d457864f8806408aa2291861952bf6f134fb3d7aa91e6582190250

Processes:

setup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\ = "Microsoft Edge"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\131.0.2903.51\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge --channel=stable"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Version = "43,0,0,0"	setup.exe

Downloads MZ/PE file

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 4 IoCs

persistence

Image File Execution Options Injection

T1546.012

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	MicrosoftEdgeUpdate.exe

A potential corporate email address has been identified in the URL: 93263704532955710A490D44@AdobeOrg
phishing
A potential corporate email address has been identified in the URL: EA76ADE95776D2EC7F000101@AdobeOrg
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing

Checks computer location settings 2 TTPs 7 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

pollymc.exeMicrosoftEdgeUpdate.exesetup.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	pollymc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	setup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	msedgewebview2.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 59 IoCs

Processes:

Modrinth App_0.8.9_x64-setup.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_131.0.2903.51.exesetup.exesetup.exeMicrosoftEdgeUpdate.exeMinecraftLauncher.exeModrinth App.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exejavaw.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateSetup_X86_1.3.195.35.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exePollyMC-Windows-MinGW-w64-Setup-8.0.exepollymc.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdge_X64_131.0.2903.51.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exesetup.exeMicrosoftEdgeUpdate.exejdk-21_windows-x64_bin.exejdk-21_windows-x64_bin.exejdk-21_windows-x64_bin.exejdk-21_windows-x64_bin.exemsedgewebview2.exe

pid	process
5788	Modrinth App_0.8.9_x64-setup.exe
5724	MicrosoftEdgeWebview2Setup.exe
5056	MicrosoftEdgeUpdate.exe
5956	MicrosoftEdgeUpdate.exe
3280	MicrosoftEdgeUpdate.exe
1780	MicrosoftEdgeUpdateComRegisterShell64.exe
1844	MicrosoftEdgeUpdateComRegisterShell64.exe
3900	MicrosoftEdgeUpdateComRegisterShell64.exe
3848	MicrosoftEdgeUpdate.exe
2592	MicrosoftEdgeUpdate.exe
3532	MicrosoftEdgeUpdate.exe
5752	MicrosoftEdgeUpdate.exe
1720	MicrosoftEdge_X64_131.0.2903.51.exe
2520	setup.exe
3504	setup.exe
2396	MicrosoftEdgeUpdate.exe
6816	MinecraftLauncher.exe
5584	Modrinth App.exe
6956	msedgewebview2.exe
1076	msedgewebview2.exe
7132	msedgewebview2.exe
4996	msedgewebview2.exe
2004	msedgewebview2.exe
5724	msedgewebview2.exe
6080	msedgewebview2.exe
7444	msedgewebview2.exe
8156	javaw.exe
7916	MicrosoftEdgeUpdate.exe
7468	MicrosoftEdgeUpdate.exe
7640	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
1100	MicrosoftEdgeUpdate.exe
7608	MicrosoftEdgeUpdate.exe
6100	MicrosoftEdgeUpdate.exe
1856	MicrosoftEdgeUpdate.exe
692	MicrosoftEdgeUpdateComRegisterShell64.exe
6552	MicrosoftEdgeUpdateComRegisterShell64.exe
6376	MicrosoftEdgeUpdateComRegisterShell64.exe
4184	MicrosoftEdgeUpdate.exe
7724	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
7232	pollymc.exe
1612	MicrosoftEdgeUpdate.exe
7876	MicrosoftEdgeUpdate.exe
1484	MicrosoftEdge_X64_131.0.2903.51.exe
7916	setup.exe
5952	setup.exe
1996	setup.exe
7620	setup.exe
6284	setup.exe
8060	setup.exe
1308	setup.exe
2488	setup.exe
6696	setup.exe
5440	setup.exe
7908	MicrosoftEdgeUpdate.exe
6988	jdk-21_windows-x64_bin.exe
1204	jdk-21_windows-x64_bin.exe
5492	jdk-21_windows-x64_bin.exe
5416	jdk-21_windows-x64_bin.exe
8940	msedgewebview2.exe

Loads dropped DLL 64 IoCs

Processes:

Modrinth App_0.8.9_x64-setup.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMsiExec.exeMicrosoftEdgeUpdate.exeMsiExec.exeMsiExec.exeModrinth App.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exejavaw.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
5788	Modrinth App_0.8.9_x64-setup.exe
5788	Modrinth App_0.8.9_x64-setup.exe
5788	Modrinth App_0.8.9_x64-setup.exe
5056	MicrosoftEdgeUpdate.exe
5956	MicrosoftEdgeUpdate.exe
3280	MicrosoftEdgeUpdate.exe
1780	MicrosoftEdgeUpdateComRegisterShell64.exe
3280	MicrosoftEdgeUpdate.exe
1844	MicrosoftEdgeUpdateComRegisterShell64.exe
3280	MicrosoftEdgeUpdate.exe
3900	MicrosoftEdgeUpdateComRegisterShell64.exe
3280	MicrosoftEdgeUpdate.exe
3848	MicrosoftEdgeUpdate.exe
2592	MicrosoftEdgeUpdate.exe
3532	MicrosoftEdgeUpdate.exe
3532	MicrosoftEdgeUpdate.exe
2592	MicrosoftEdgeUpdate.exe
5752	MicrosoftEdgeUpdate.exe
2756	MsiExec.exe
2396	MicrosoftEdgeUpdate.exe
5788	Modrinth App_0.8.9_x64-setup.exe
5788	Modrinth App_0.8.9_x64-setup.exe
6328	MsiExec.exe
6328	MsiExec.exe
6456	MsiExec.exe
2756	MsiExec.exe
5584	Modrinth App.exe
6956	msedgewebview2.exe
1076	msedgewebview2.exe
6956	msedgewebview2.exe
6956	msedgewebview2.exe
6956	msedgewebview2.exe
7132	msedgewebview2.exe
4996	msedgewebview2.exe
7132	msedgewebview2.exe
4996	msedgewebview2.exe
2004	msedgewebview2.exe
7132	msedgewebview2.exe
7132	msedgewebview2.exe
7132	msedgewebview2.exe
2004	msedgewebview2.exe
7132	msedgewebview2.exe
5724	msedgewebview2.exe
5724	msedgewebview2.exe
5724	msedgewebview2.exe
6956	msedgewebview2.exe
6080	msedgewebview2.exe
6080	msedgewebview2.exe
6080	msedgewebview2.exe
7444	msedgewebview2.exe
7444	msedgewebview2.exe
7444	msedgewebview2.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
8156	javaw.exe
7916	MicrosoftEdgeUpdate.exe
7468	MicrosoftEdgeUpdate.exe
7468	MicrosoftEdgeUpdate.exe

Blocklisted process makes network request 1 IoCs

Processes:

msiexec.exe

flow pid process

1773 7964 msiexec.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

Modrinth App.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Modrinth App.exe

flow	pid	process
1773	7964	msiexec.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Modrinth App.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exemsiexec.exemsiexec.exe

description	ioc	process
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	setup.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

Processes:

flow	ioc
1495	raw.githubusercontent.com
1496	raw.githubusercontent.com
1497	raw.githubusercontent.com
1501	raw.githubusercontent.com
1494	raw.githubusercontent.com

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Checks system information in the registry 2 TTPs 26 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exemsedgewebview2.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	MicrosoftEdgeUpdate.exe

Drops file in System32 directory 3 IoCs

Processes:

setup.exeMsiExec.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Microsoft Edge.lnk	setup.exe
File created	C:\Windows\system32\WindowsAccessBridge-64.dll	MsiExec.exe
File opened for modification	C:\Windows\system32\WindowsAccessBridge-64.dll	MsiExec.exe

Drops file in Program Files directory 64 IoCs

Processes:

setup.exesetup.exesetup.exeMicrosoftEdgeUpdateSetup_X86_1.3.195.35.exeMsiExec.exeMicrosoftEdgeWebview2Setup.exesetup.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Locales\ar.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Locales\ug.pak	setup.exe
File opened for modification	C:\Program Files\msedge_installer.log	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Installer\setup.exe	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Trust Protection Lists\Sigma\Advertising	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Extensions\external_extensions.json	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\msedgeupdateres_pt-BR.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\msedgeupdateres_cy.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\zh-TW.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Locales\id.pak	setup.exe
File created	C:\Program Files\Java\jdk-21\legal\jdk.sctp\LICENSE	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\identity_proxy\win11\identity_helper.Sparse.Internal.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\msedge_100_percent.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\BHO\ie_to_edge_stub.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\identity_proxy\win10\identity_helper.Sparse.Canary.msix	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\msedge_pwa_launcher.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\he.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\identity_proxy\win10\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files\Java\jdk-21\bin\attach.dll	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU4301.tmp\psmachine_64.dll	MicrosoftEdgeWebview2Setup.exe
File created	C:\Program Files\Java\jdk-21\jmods\jdk.jartool.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21\jmods\jdk.xml.dom.jmod	MsiExec.exe
File created	C:\Program Files\Java\jdk-21\bin\javaaccessbridge.dll	MsiExec.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\resources.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Locales\ca.pak	setup.exe
File opened for modification	C:\Program Files\MsEdgeCrashpad\throttle_store.dat	setup.exe
File created	C:\Program Files\Java\jdk-21\bin\j2pkcs11.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21\legal\jdk.net\LICENSE	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\VisualElements\SmallLogo.png	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\msedge_wer.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\it.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\VisualElements\SmallLogo.png	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Trust Protection Lists\Mu\LICENSE	setup.exe
File created	C:\Program Files\Java\jdk-21\conf\net.properties	MsiExec.exe
File created	C:\Program Files\Java\jdk-21\include\classfile_constants.h	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU4301.tmp\msedgeupdateres_es-419.dll	MicrosoftEdgeWebview2Setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\libGLESv2.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\Trust Protection Lists\Mu\Content	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\msedgeupdateres_fi.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\identity_helper.exe	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Trust Protection Lists\Mu\Social	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\pl.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\te.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Trust Protection Lists\Sigma\LICENSE	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Trust Protection Lists\Mu\Advertising	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\az.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\is.pak	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\msedgeupdateres_pa.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
File created	C:\Program Files\Java\jdk-21\bin\jsvml.dll	MsiExec.exe
File created	C:\Program Files\Java\jdk-21\legal\jdk.naming.dns\LICENSE	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\AdSelectionAttestationsPreloaded\ad-selection-attestations.dat	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\prefs_enclave_x64.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\identity_proxy\win11\identity_helper.Sparse.Beta.msix	setup.exe
File created	C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\msedgeupdateres_quz.dll	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Locales\et.pak	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Trust Protection Lists\Sigma\Other	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Locales\mk.pak	setup.exe
File created	C:\Program Files\Java\jdk-21\legal\java.sql.rowset\LICENSE	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\BHO\ie_to_edge_bho.dll	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\notification_helper.exe	setup.exe
File created	C:\Program Files\Java\jdk-21\jmods\jdk.security.jgss.jmod	MsiExec.exe
File created	C:\Program Files\Common Files\Oracle\Java\javapath_target_241642875\jshell.exe	MsiExec.exe
File created	C:\Program Files (x86)\Microsoft\EdgeWebView\Temp\source2520_1023571366\MSEDGE.7z	setup.exe
File created	C:\Program Files (x86)\Microsoft\EdgeCore\131.0.2903.51\Trust Protection Lists\Mu\CompatExceptions	setup.exe

Drops file in Windows directory 47 IoCs

Processes:

msiexec.exemsiexec.exe

description	ioc	process
File created	C:\Windows\Installer\SourceHash{57D4CF7E-F8ED-42DA-A49A-271EA8C55A7C}	msiexec.exe
File opened for modification	C:\Windows\Installer\{57D4CF7E-F8ED-42DA-A49A-271EA8C55A7C}\minecraft.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\e6717a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FA6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FD7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C6F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C81.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CC7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CB6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1E39.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FF7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C93.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CA3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2FC7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1B1.tmp	msiexec.exe
File created	C:\Windows\Installer\{57D4CF7E-F8ED-42DA-A49A-271EA8C55A7C}\minecraft.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2038.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C70.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CA4.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC1C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F54.tmp	msiexec.exe
File created	C:\Windows\Installer\e6717a3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC2ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CD8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CC6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F84.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2007.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2857.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2CB5.tmp	msiexec.exe
File created	C:\Windows\Installer\e6717a1.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5cc0c7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5cc0c9.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1B1B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F74.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1FC6.tmp	msiexec.exe
File created	C:\Windows\Installer\e5cc0c7.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC221.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CB8C8B64-CB93-5BA6-AEBB-163B1270095E}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI1F95.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2028.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C92.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Modrinth App_0.8.9_x64-setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\PollyMC-Windows-MinGW-w64-Setup-8.0.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe:Zone.Identifier	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 27 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMsiExec.exeMicrosoftEdgeUpdateSetup_X86_1.3.195.35.exeMicrosoftEdgeUpdate.exePollyMC-Windows-MinGW-w64-Setup-8.0.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeWebview2Setup.exeMicrosoftEdgeUpdate.exeMsiExec.exeMicrosoftEdgeUpdate.exeModrinth App_0.8.9_x64-setup.exeMsiExec.exeMinecraftLauncher.exeTaskKill.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PollyMC-Windows-MinGW-w64-Setup-8.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeWebview2Setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Modrinth App_0.8.9_x64-setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MinecraftLauncher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TaskKill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exe

pid	process
3848	MicrosoftEdgeUpdate.exe
5752	MicrosoftEdgeUpdate.exe
2396	MicrosoftEdgeUpdate.exe
1100	MicrosoftEdgeUpdate.exe
4184	MicrosoftEdgeUpdate.exe
7908	MicrosoftEdgeUpdate.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msedgewebview2.exetaskmgr.exevssvc.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000c4d65e62b69e8e0b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000c4d65e620000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900c4d65e62000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dc4d65e62000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000c4d65e6200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedgewebview2.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exemsiexec.exefirefox.exejavaw.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msiexec.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	javaw.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	javaw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msiexec.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedgewebview2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

TaskKill.exe

pid process

7964 TaskKill.exe

pid	process
7964	TaskKill.exe

Modifies Internet Explorer settings 1 TTPs 26 IoCs

adware spyware

Modify Registry

Processes:

setup.exewwahost.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\131.0.2903.51\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations\C:\Program Files (x86)\Microsoft\Edge\Application = "1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration\AdapterLocations	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\EnterpriseMode\MSEdgePath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Main\EnterpriseMode	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppName = "ie_to_edge_stub.exe"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute\microsoft-edge	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\AppPath = "C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\131.0.2903.51\\BHO"	setup.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ProtocolExecute	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EdgeIntegration	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Internet Explorer\GPU	wwahost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\ = "IEToEdge Handler"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{c9abcf16-8dc2-4a95-bae3-24fd98f2ed29}\Policy = "3"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\GPU	wwahost.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMsiExec.exemsedgewebview2.exemsiexec.exemsiexec.exesetup.exesetup.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Console	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133764747701797481"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Environment	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Edge	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%systemroot%\system32\FirewallControlPanel.dll,-12122 = "Windows Defender Firewall"	setup.exe
Key created	\REGISTRY\USER\.DEFAULT\Printers	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MicrosoftEdgeUpdate.exe

Modifies registry class 64 IoCs

Processes:

NOTEPAD.EXEMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exepollymc.exeMicrosoftEdgeUpdateComRegisterShell64.exeModrinth App_0.8.9_x64-setup.exeMicrosoftEdgeUpdateComRegisterShell64.exesetup.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdateComRegisterShell64.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdateComRegisterShell64.exewwahost.exeMicrosoftEdgeUpdate.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	NOTEPAD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods\ = "23"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5F6A18BB-6231-424B-8242-19E5BB94F8ED}\LocalServer32\ = "\"C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.35\\MicrosoftEdgeUpdateOnDemand.exe\""	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\Shell	pollymc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B9063E4-3882-485E-8797-F28A0240782F}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mrpack\ = "MRPACK File"	Modrinth App_0.8.9_x64-setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C853632E-36CA-4999-B992-EC0D408CF5AB}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\microsoft-edge	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ = "IAppCommand"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1AFD8852-E87E-49F5-89B4-4214D0854576}\InprocHandler32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.35\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeMHT\Application\ApplicationCompany = "Microsoft Corporation"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}\InprocServer32\ThreadingModel = "Both"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{3316A154-AC5C-4126-9021-B201E9C33D7B}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\NumMethods\ = "10"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\InProcServer32	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftofficehub_8wekyb3d8bbwe\Internet Explorer\DOMStorage\www.office.com	wwahost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\8\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	pollymc.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12	pollymc.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\APPID\MICROSOFTEDGEUPDATE.EXE	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ = "IPolicyStatus3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C06EE550-7248-488E-971E-B60C0AB3A6E4}\NumMethods	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E8F1B36-249F-4FC3-9994-974AFAA07B26}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.35\\psmachine_64.dll"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{628ACE20-B77A-456F-A88D-547DB6CEEDD5}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSEdgeHTM\Application\ApplicationName = "Microsoft Edge"	setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\12\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "48"	pollymc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AB4EE1FC-0A81-4F56-B0E2-248FB78051AF}\NumMethods	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FF419FF9-90BE-4D9F-B410-A789F90E5A7C}\Elevation\IconReference = "@C:\\Program Files (x86)\\Microsoft\\EdgeUpdate\\1.3.195.31\\msedgeupdate.dll,-1004"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5F9C80B5-9E50-43C9-887C-7C6412E110DF}\ProxyStubClsid32\ = "{3316A154-AC5C-4126-9021-B201E9C33D7B}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A84F9C2-6164-485C-A7D9-4B27F8AC009E}\AppID = "{6d2b5079-2f0b-48dd-ab7f-97cec514d30b}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E4518371-7326-4865-87F8-D9D3F3B287A3}	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A6556DFF-AB15-4DC3-A890-AB54120BEAEC}\ProxyStubClsid32	MicrosoftEdgeUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{08D832B9-D2FD-481F-98CF-904D00DF63CC}\LOCALSERVER32	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DDD4B5D4-FD54-497C-8789-0830F29A60EE}\ = "IGoogleUpdate3"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2603C88B-F971-4167-9DE1-871EE4A3DC84}	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20433B3-0D4B-49F6-9B6C-6EE0FAE07837}\NumMethods\ = "4"	MicrosoftEdgeUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{492E1C30-A1A2-4695-87C8-7A8CAD6F936F}\Elevation\Enabled = "1"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7B3B7A69-7D88-4847-A6BC-90E246A41F69}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{99F8E195-1042-4F89-A28C-89CDB74A14AE}\ProxyStubClsid32\ = "{3316A154-AC5C-4126-9021-B201E9C33D7B}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E102DC6-1EDB-46A1-8488-61F71B35ED5F}	MicrosoftEdgeUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2EC826CB-5478-4533-9015-7580B3B5E03A}\ProxyStubClsid32\ = "{3316A154-AC5C-4126-9021-B201E9C33D7B}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3805CA06-AC83-4F00-8A02-271DCD89BDEB}\ = "IPolicyStatus5"	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5135E58-384F-4244-9A5F-30FA9259413C}\ProxyStubClsid32\ = "{3316A154-AC5C-4126-9021-B201E9C33D7B}"	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9A6B447A-35E2-4F6B-A87B-5DEEBBFDAD17}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DFFE7FE-3153-4AF1-95D8-F8FCCA97E56B}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E421557C-0628-43FB-BF2B-7C9F8A4D067C}\LocalServer32	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D9AA3288-4EA7-4E67-AE60-D18EADCB923D}\NumMethods	MicrosoftEdgeUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60355531-5BFD-45AB-942C-7912628752C7}\ProxyStubClsid32\ = "{35725228-BF11-429E-B5B8-ED0F2BCABF82}"	MicrosoftEdgeUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A2F5CB38-265F-4A02-9D1E-F25B664968AB}	MicrosoftEdgeUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{79E0C401-B7BC-4DE5-8104-71350F3A9B67}\ProxyStubClsid32	MicrosoftEdgeUpdateComRegisterShell64.exe

NTFS ADS 5 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\MinecraftInstaller.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\meteor-client-0.5.8.jar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\PollyMC-Windows-MinGW-w64-Setup-8.0.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Modrinth App_0.8.9_x64-setup.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

1436 NOTEPAD.EXE
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

pollymc.exe

pid process

7232 pollymc.exe

pid	process
7232	pollymc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

MicrosoftEdgeUpdate.exeModrinth App_0.8.9_x64-setup.exemsiexec.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exeMicrosoftEdgeUpdate.exesetup.exewwahost.exeLocalBridge.exeMicrosoftEdgeUpdate.exetaskmgr.exemsedgewebview2.exemsiexec.exe

pid	process
5056	MicrosoftEdgeUpdate.exe
5056	MicrosoftEdgeUpdate.exe
5056	MicrosoftEdgeUpdate.exe
5056	MicrosoftEdgeUpdate.exe
5056	MicrosoftEdgeUpdate.exe
5056	MicrosoftEdgeUpdate.exe
5788	Modrinth App_0.8.9_x64-setup.exe
5788	Modrinth App_0.8.9_x64-setup.exe
2556	msiexec.exe
2556	msiexec.exe
7916	MicrosoftEdgeUpdate.exe
7916	MicrosoftEdgeUpdate.exe
7916	MicrosoftEdgeUpdate.exe
7916	MicrosoftEdgeUpdate.exe
7468	MicrosoftEdgeUpdate.exe
7468	MicrosoftEdgeUpdate.exe
7608	MicrosoftEdgeUpdate.exe
7608	MicrosoftEdgeUpdate.exe
1612	MicrosoftEdgeUpdate.exe
1612	MicrosoftEdgeUpdate.exe
1612	MicrosoftEdgeUpdate.exe
1612	MicrosoftEdgeUpdate.exe
6284	setup.exe
6284	setup.exe
8128	wwahost.exe
8128	wwahost.exe
8128	wwahost.exe
8128	wwahost.exe
5316	LocalBridge.exe
5316	LocalBridge.exe
5316	LocalBridge.exe
5316	LocalBridge.exe
5316	LocalBridge.exe
5316	LocalBridge.exe
7876	MicrosoftEdgeUpdate.exe
7876	MicrosoftEdgeUpdate.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
8940	msedgewebview2.exe
8940	msedgewebview2.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
7564	msiexec.exe
7564	msiexec.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

firefox.exeModrinth App_0.8.9_x64-setup.exepollymc.exetaskmgr.exe

pid process

2532 firefox.exe
5788 Modrinth App_0.8.9_x64-setup.exe
7232 pollymc.exe
6148 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedgewebview2.exe

pid process

6956 msedgewebview2.exe
6956 msedgewebview2.exe
6956 msedgewebview2.exe

pid	process
6956	msedgewebview2.exe
6956	msedgewebview2.exe
6956	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeAUDIODG.EXEMicrosoftEdgeUpdate.exemsiexec.exemsiexec.exe

description	pid	process
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: 33	6000	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	6000	AUDIODG.EXE
Token: SeDebugPrivilege	5056	MicrosoftEdgeUpdate.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeDebugPrivilege	2532	firefox.exe
Token: SeShutdownPrivilege	5336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5336	msiexec.exe
Token: SeSecurityPrivilege	2556	msiexec.exe
Token: SeCreateTokenPrivilege	5336	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5336	msiexec.exe
Token: SeLockMemoryPrivilege	5336	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5336	msiexec.exe
Token: SeMachineAccountPrivilege	5336	msiexec.exe
Token: SeTcbPrivilege	5336	msiexec.exe
Token: SeSecurityPrivilege	5336	msiexec.exe
Token: SeTakeOwnershipPrivilege	5336	msiexec.exe
Token: SeLoadDriverPrivilege	5336	msiexec.exe
Token: SeSystemProfilePrivilege	5336	msiexec.exe
Token: SeSystemtimePrivilege	5336	msiexec.exe
Token: SeProfSingleProcessPrivilege	5336	msiexec.exe
Token: SeIncBasePriorityPrivilege	5336	msiexec.exe
Token: SeCreatePagefilePrivilege	5336	msiexec.exe
Token: SeCreatePermanentPrivilege	5336	msiexec.exe
Token: SeBackupPrivilege	5336	msiexec.exe
Token: SeRestorePrivilege	5336	msiexec.exe
Token: SeShutdownPrivilege	5336	msiexec.exe
Token: SeDebugPrivilege	5336	msiexec.exe
Token: SeAuditPrivilege	5336	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5336	msiexec.exe
Token: SeChangeNotifyPrivilege	5336	msiexec.exe
Token: SeRemoteShutdownPrivilege	5336	msiexec.exe
Token: SeUndockPrivilege	5336	msiexec.exe
Token: SeSyncAgentPrivilege	5336	msiexec.exe
Token: SeEnableDelegationPrivilege	5336	msiexec.exe
Token: SeManageVolumePrivilege	5336	msiexec.exe
Token: SeImpersonatePrivilege	5336	msiexec.exe
Token: SeCreateGlobalPrivilege	5336	msiexec.exe
Token: SeCreateTokenPrivilege	5336	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5336	msiexec.exe
Token: SeLockMemoryPrivilege	5336	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exemsiexec.exeModrinth App.exepollymc.exemsiexec.exetaskmgr.exe

pid	process
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
5336	msiexec.exe
5336	msiexec.exe
5584	Modrinth App.exe
5584	Modrinth App.exe
5584	Modrinth App.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7964	msiexec.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exetaskmgr.exe

pid	process
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe
6148	taskmgr.exe

Suspicious use of SetWindowsHookEx 47 IoCs

Processes:

NOTEPAD.EXEfirefox.exewwahost.exejdk-21_windows-x64_bin.exejdk-21_windows-x64_bin.exepollymc.exe

pid	process
1436	NOTEPAD.EXE
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
8128	wwahost.exe
2532	firefox.exe
2532	firefox.exe
2532	firefox.exe
1204	jdk-21_windows-x64_bin.exe
5416	jdk-21_windows-x64_bin.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe
7232	pollymc.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2036 wrote to memory of 2532	2036	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 2352	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe
PID 2532 wrote to memory of 1412	2532	firefox.exe	firefox.exe

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

Processes:

setup.exemsedgewebview2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	msedgewebview2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext	setup.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\NOTEPAD.EXE
C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\buzzingrevoluti.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
- Suspicious use of SetWindowsHookEx
PID:1436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2012 -parentBuildID 20240401114208 -prefsHandle 1940 -prefMapHandle 1932 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9bcc36dc-3ccb-443b-bc63-9ea5b72ecd43} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" gpu
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2440 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2404 -prefsLen 23716 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3e522b0-fa02-46c7-9883-ad739c9afc21} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" socket
    3⤵
    PID:1412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3180 -childID 1 -isForBrowser -prefsHandle 3184 -prefMapHandle 3224 -prefsLen 23857 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {359cf6f5-44d9-41ad-9898-044320c3b11d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:3764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3856 -childID 2 -isForBrowser -prefsHandle 3848 -prefMapHandle 3832 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e8d0f7f4-fbbb-4396-ade9-aeebfb7c0d9b} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4460 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4676 -prefMapHandle 4668 -prefsLen 29090 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {881fe3ba-dea1-43e5-9691-fc4e3cc58d72} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" utility
    3⤵
    - Checks processor information in registry
    PID:5200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5192 -childID 3 -isForBrowser -prefsHandle 5188 -prefMapHandle 5164 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f7fb12d-b71e-4e05-a110-166675b62d3e} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5212 -childID 4 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {52f571a1-8b00-4fbb-a9d3-62f66054e8de} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5768
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5348 -childID 5 -isForBrowser -prefsHandle 5552 -prefMapHandle 5556 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7619d76b-85a4-427e-a9ca-c0436c1bb3fd} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6156 -childID 6 -isForBrowser -prefsHandle 6148 -prefMapHandle 1652 -prefsLen 27132 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5da7b89-c53f-443d-a75b-61132ad62468} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:3892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1700 -childID 7 -isForBrowser -prefsHandle 6432 -prefMapHandle 6428 -prefsLen 27919 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7fd11b75-7776-490d-b3e9-cfd1992bc4db} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5556
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5540 -childID 8 -isForBrowser -prefsHandle 5704 -prefMapHandle 5700 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95814fe0-fdd6-41eb-baab-3671978d7cc5} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:2704
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7080 -childID 9 -isForBrowser -prefsHandle 8524 -prefMapHandle 7092 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {650e0434-fadd-4f66-bba0-019e2bba3342} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5776
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6108 -childID 10 -isForBrowser -prefsHandle 6192 -prefMapHandle 6200 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b847fe3-90aa-416e-93e1-36e40ec5241c} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8460 -parentBuildID 20240401114208 -prefsHandle 8292 -prefMapHandle 8448 -prefsLen 30974 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0b03e18-846e-461b-871f-21ac0cf3cbfe} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" rdd
    3⤵
    PID:3636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8484 -parentBuildID 20240401114208 -sandboxingKind 1 -prefsHandle 7548 -prefMapHandle 8568 -prefsLen 30974 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f45fccbb-13af-46db-a8f4-ad819f336fb7} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" utility
    3⤵
    - Checks processor information in registry
    PID:3252
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8896 -childID 11 -isForBrowser -prefsHandle 9068 -prefMapHandle 9072 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d768485c-695a-4dad-8a22-21768bbdce6e} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9204 -childID 12 -isForBrowser -prefsHandle 8904 -prefMapHandle 9232 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c8de5f8-8918-412f-88e8-b59d98247262} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:4068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9452 -childID 13 -isForBrowser -prefsHandle 8552 -prefMapHandle 6832 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d6aa58c-db52-4312-8a8c-54ddbfea1c53} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:3948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4616 -childID 14 -isForBrowser -prefsHandle 3668 -prefMapHandle 6644 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7738c322-bf21-4d5d-b04e-93a104ac7f3f} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5928
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9528 -childID 15 -isForBrowser -prefsHandle 7056 -prefMapHandle 4152 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1beec595-5e57-4df6-a070-d8d4cc951d62} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6036
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4152 -childID 16 -isForBrowser -prefsHandle 7196 -prefMapHandle 9624 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7687719c-2b4a-4eed-8863-ebab58dbf818} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1432
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3660 -childID 17 -isForBrowser -prefsHandle 5616 -prefMapHandle 3664 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abfdfa43-1d25-43c1-bd03-12c544268a09} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5612 -childID 18 -isForBrowser -prefsHandle 8868 -prefMapHandle 5676 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e757eb3a-7d4d-433b-a692-8c46ae4ff719} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5576
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9868 -childID 19 -isForBrowser -prefsHandle 5648 -prefMapHandle 9904 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {baa4b880-9291-49b6-9052-c698d01b83d3} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7792 -childID 20 -isForBrowser -prefsHandle 7780 -prefMapHandle 7784 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7cef1f7e-f1e2-47c3-a3fe-0bc60e66540e} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:3840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5804 -childID 21 -isForBrowser -prefsHandle 4444 -prefMapHandle 7344 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c2578c02-28f4-4475-94bf-607db39d08c4} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6884 -childID 22 -isForBrowser -prefsHandle 7220 -prefMapHandle 7248 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {76501b1f-f49d-476e-a12a-37f9a8ce456d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:3572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7820 -childID 23 -isForBrowser -prefsHandle 4336 -prefMapHandle 5528 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f176c7de-2e8f-4e0e-9bee-330e2a08e64d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6524 -childID 24 -isForBrowser -prefsHandle 4440 -prefMapHandle 8108 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44bed6cb-8046-48c1-8c15-9509a6b5fa6c} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:4568
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7536 -childID 25 -isForBrowser -prefsHandle 4336 -prefMapHandle 5528 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a14787d-9002-4e3a-bae3-2c62bc2b0e8d} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7980 -childID 26 -isForBrowser -prefsHandle 10196 -prefMapHandle 10204 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28d48b06-bf06-493d-a350-496879cf01c7} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8980 -childID 27 -isForBrowser -prefsHandle 7808 -prefMapHandle 3676 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da2dd54d-fa48-483d-b4b1-96cb3202b681} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5156 -childID 28 -isForBrowser -prefsHandle 9884 -prefMapHandle 9880 -prefsLen 28182 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ae75991-138c-4a16-aefd-599299e531c5} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:2224
- - C:\Users\Admin\Downloads\Modrinth App_0.8.9_x64-setup.exe
    "C:\Users\Admin\Downloads\Modrinth App_0.8.9_x64-setup.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe
      C:\Users\Admin\AppData\Local\Temp\MicrosoftEdgeWebview2Setup.exe /silent /install
      4⤵
      Executes dropped EXE
      Drops file in Program Files directory
      System Location Discovery: System Language Discovery
      PID:5724
    - - C:\Program Files (x86)\Microsoft\Temp\EU4301.tmp\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\Temp\EU4301.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"
        5⤵
        Event Triggered Execution: Image File Execution Options Injection
        Checks computer location settings
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5056
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:5956
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Modifies registry class
        
        PID:3280
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1780
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1844
        
        C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.31\MicrosoftEdgeUpdateComRegisterShell64.exe"
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:3900
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDc0NDMxNEYtNUIxNC00NEZCLTk5QkMtNDgyQkU3NTU0QzY0fSIgdXNlcmlkPSJ7MUY5OEUwRjEtMkRBOS00QzU2LUEwRjEtOTgwMzAxMEVFMTFCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntERTEzQkJGQS0xMkZELTRGMzQtODUyMC1CQTNCMjRFNDgzNTJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iIi8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xNDcuMzciIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjMxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3MTgwMDE3Mjk3IiBpbnN0YWxsX3RpbWVfbXM9IjU2NCIvPjwvYXBwPjwvcmVxdWVzdD4
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks system information in the registry
        System Location Discovery: System Language Discovery
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:3848
      - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{0744314F-5B14-44FB-99BC-482BE7554C64}" /silent
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10444 -childID 29 -isForBrowser -prefsHandle 9732 -prefMapHandle 3160 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe725368-2e1a-46bc-8de9-4f3503b0b4b4} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:8052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10168 -childID 30 -isForBrowser -prefsHandle 6536 -prefMapHandle 6508 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad38e8c0-383b-4c86-8497-deebcc50666b} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:7536
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10740 -childID 31 -isForBrowser -prefsHandle 10760 -prefMapHandle 10756 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2abc74d5-dea5-4d48-9e62-f9b16879ce42} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:7624
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6636 -childID 32 -isForBrowser -prefsHandle 6520 -prefMapHandle 9920 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c7a8afb-43e2-471e-bb06-874ed9b653e6} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10420 -childID 33 -isForBrowser -prefsHandle 11056 -prefMapHandle 11052 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e6ad7c1-16a9-42e5-9f42-821111776d59} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:588
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7144 -childID 34 -isForBrowser -prefsHandle 11204 -prefMapHandle 11212 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae7368f6-2488-424b-968f-9ec21e1b70ac} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11228 -childID 35 -isForBrowser -prefsHandle 11236 -prefMapHandle 11240 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0ca44bca-24c5-4c9c-8545-730b21633118} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:7344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7048 -childID 36 -isForBrowser -prefsHandle 10784 -prefMapHandle 11268 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8df5d659-d26b-4d7b-ae2f-703856618411} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5136
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10604 -childID 37 -isForBrowser -prefsHandle 10676 -prefMapHandle 10600 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {229699bd-584d-48af-8971-1f283ab254f2} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:464
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=7716 -childID 38 -isForBrowser -prefsHandle 7936 -prefMapHandle 11596 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2da1f361-ab52-4742-8443-b196d35f1d30} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11548 -childID 39 -isForBrowser -prefsHandle 11616 -prefMapHandle 11620 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9fabb0ea-2782-4716-a36d-c2067878bd10} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:5360
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11024 -childID 40 -isForBrowser -prefsHandle 11660 -prefMapHandle 11664 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ae985045-e85b-47d6-9487-c8ae10a768ee} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9716 -childID 41 -isForBrowser -prefsHandle 5052 -prefMapHandle 11376 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc058864-6c22-415c-aa4b-c19f59cd1206} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=9380 -childID 42 -isForBrowser -prefsHandle 7804 -prefMapHandle 9888 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8be94cb6-86e9-4bf0-8e2f-686908bf7a16} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6068
- - C:\Users\Admin\Downloads\PollyMC-Windows-MinGW-w64-Setup-8.0.exe
    "C:\Users\Admin\Downloads\PollyMC-Windows-MinGW-w64-Setup-8.0.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:7724
  - - C:\Windows\SysWOW64\TaskKill.exe
      TaskKill /IM pollymc.exe /F
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      PID:7964
  - - C:\Users\Admin\AppData\Local\Programs\PollyMC\pollymc.exe
      "C:\Users\Admin\AppData\Local\Programs\PollyMC\pollymc.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Modifies registry class
      Suspicious behavior: AddClipboardFormatListener
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:7232
    - - C:\Program Files\Java\jre-1.8\bin\javaw.exe
        
        "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:1916
    - - C:\Program Files\Java\jdk-1.8\bin\javaw.exe
        
        "C:\Program Files\Java\jdk-1.8\bin\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:7176
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        javaw -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:7252
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:6768
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms512m -Xmx4096m -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:7584
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:2036
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms512m -Xmx4096m -Duser.language=en -Djava.library.path=C:/Users/Admin/AppData/Roaming/PollyMC/instances/1.21.1/natives -cp C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/NewLaunch.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype-natives-windows-arm64/3.3.3/lwjgl-freetype-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype-natives-windows-x86/3.3.3/lwjgl-freetype-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype-natives-windows/3.3.3/lwjgl-freetype-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype/3.3.3/lwjgl-freetype-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw-natives-windows-arm64/3.3.3/lwjgl-glfw-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw-natives-windows-x86/3.3.3/lwjgl-glfw-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw-natives-windows/3.3.3/lwjgl-glfw-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw/3.3.3/lwjgl-glfw-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-arm64/3.3.3/lwjgl-jemalloc-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-x86/3.3.3/lwjgl-jemalloc-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows/3.3.3/lwjgl-jemalloc-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc/3.3.3/lwjgl-jemalloc-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-natives-windows-arm64/3.3.3/lwjgl-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-natives-windows-x86/3.3.3/lwjgl-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-natives-windows/3.3.3/lwjgl-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal-natives-windows-arm64/3.3.3/lwjgl-openal-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal-natives-windows-x86/3.3.3/lwjgl-openal-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal-natives-windows/3.3.3/lwjgl-openal-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal/3.3.3/lwjgl-openal-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl-natives-windows-arm64/3.3.3/lwjgl-opengl-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl-natives-windows-x86/3.3.3/lwjgl-opengl-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl-natives-windows/3.3.3/lwjgl-opengl-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl/3.3.3/lwjgl-opengl-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb-natives-windows-arm64/3.3.3/lwjgl-stb-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb-natives-windows-x86/3.3.3/lwjgl-stb-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb-natives-windows/3.3.3/lwjgl-stb-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb/3.3.3/lwjgl-stb-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-arm64/3.3.3/lwjgl-tinyfd-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-x86/3.3.3/lwjgl-tinyfd-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows/3.3.3/lwjgl-tinyfd-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd/3.3.3/lwjgl-tinyfd-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl/3.3.3/lwjgl-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/github/oshi/oshi-core/6.4.10/oshi-core-6.4.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/google/guava/guava/32.1.2-jre/guava-32.1.2-jre.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/ibm/icu/icu4j/73.2/icu4j-73.2.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/authlib/6.0.54/authlib-6.0.54.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/brigadier/1.3.10/brigadier-1.3.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/datafixerupper/8.0.16/datafixerupper-8.0.16.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/logging/1.2.7/logging-1.2.7.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/text2speech/1.17.9/text2speech-1.17.9.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/commons-codec/commons-codec/1.16.0/commons-codec-1.16.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/commons-io/commons-io/2.15.1/commons-io-2.15.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/commons-logging/commons-logging/1.2/commons-logging-1.2.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-buffer/4.1.97.Final/netty-buffer-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-codec/4.1.97.Final/netty-codec-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-common/4.1.97.Final/netty-common-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-handler/4.1.97.Final/netty-handler-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-resolver/4.1.97.Final/netty-resolver-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-transport-classes-epoll/4.1.97.Final/netty-transport-classes-epoll-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-transport-native-unix-common/4.1.97.Final/netty-transport-native-unix-common-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-transport/4.1.97.Final/netty-transport-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/it/unimi/dsi/fastutil/8.5.12/fastutil-8.5.12.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/java/dev/jna/jna-platform/5.14.0/jna-platform-5.14.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/java/dev/jna/jna/5.14.0/jna-5.14.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/commons/commons-compress/1.26.0/commons-compress-1.26.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/logging/log4j/log4j-api/2.22.1/log4j-api-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/logging/log4j/log4j-core/2.22.1/log4j-core-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/logging/log4j/log4j-slf4j2-impl/2.22.1/log4j-slf4j2-impl-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/jcraft/jorbis/0.0.17/jorbis-0.0.17.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/joml/joml/1.10.5/joml-1.10.5.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lz4/lz4-java/1.8.0/lz4-java-1.8.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/fabricmc/intermediary/1.21.1/intermediary-1.21.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm/9.7.1/asm-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-analysis/9.7.1/asm-analysis-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-commons/9.7.1/asm-commons-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-tree/9.7.1/asm-tree-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-util/9.7.1/asm-util-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/fabricmc/sponge-mixin/0.15.4+mixin.0.8.7/sponge-mixin-0.15.4+mixin.0.8.7.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/fabricmc/fabric-loader/0.16.9/fabric-loader-0.16.9.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/minecraft/1.21.1/minecraft-1.21.1-client.jar org.prismlauncher.EntryPoint
        5⤵
        
        PID:7192
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -XX:HeapDumpPath=MojangTricksIntelDriversForPerformance_javaw.exe_minecraft.exe.heapdump -Xms512m -Xmx4096m -Duser.language=en -Djava.library.path=C:/Users/Admin/AppData/Roaming/PollyMC/instances/1.21.1/natives -cp C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/NewLaunch.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype-natives-windows-arm64/3.3.3/lwjgl-freetype-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype-natives-windows-x86/3.3.3/lwjgl-freetype-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype-natives-windows/3.3.3/lwjgl-freetype-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-freetype/3.3.3/lwjgl-freetype-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw-natives-windows-arm64/3.3.3/lwjgl-glfw-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw-natives-windows-x86/3.3.3/lwjgl-glfw-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw-natives-windows/3.3.3/lwjgl-glfw-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-glfw/3.3.3/lwjgl-glfw-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-arm64/3.3.3/lwjgl-jemalloc-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows-x86/3.3.3/lwjgl-jemalloc-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc-natives-windows/3.3.3/lwjgl-jemalloc-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-jemalloc/3.3.3/lwjgl-jemalloc-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-natives-windows-arm64/3.3.3/lwjgl-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-natives-windows-x86/3.3.3/lwjgl-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-natives-windows/3.3.3/lwjgl-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal-natives-windows-arm64/3.3.3/lwjgl-openal-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal-natives-windows-x86/3.3.3/lwjgl-openal-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal-natives-windows/3.3.3/lwjgl-openal-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-openal/3.3.3/lwjgl-openal-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl-natives-windows-arm64/3.3.3/lwjgl-opengl-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl-natives-windows-x86/3.3.3/lwjgl-opengl-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl-natives-windows/3.3.3/lwjgl-opengl-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-opengl/3.3.3/lwjgl-opengl-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb-natives-windows-arm64/3.3.3/lwjgl-stb-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb-natives-windows-x86/3.3.3/lwjgl-stb-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb-natives-windows/3.3.3/lwjgl-stb-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-stb/3.3.3/lwjgl-stb-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-arm64/3.3.3/lwjgl-tinyfd-natives-windows-arm64-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows-x86/3.3.3/lwjgl-tinyfd-natives-windows-x86-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd-natives-windows/3.3.3/lwjgl-tinyfd-natives-windows-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl-tinyfd/3.3.3/lwjgl-tinyfd-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lwjgl/lwjgl/3.3.3/lwjgl-3.3.3.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/github/oshi/oshi-core/6.4.10/oshi-core-6.4.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/google/code/gson/gson/2.10.1/gson-2.10.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/google/guava/failureaccess/1.0.1/failureaccess-1.0.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/google/guava/guava/32.1.2-jre/guava-32.1.2-jre.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/ibm/icu/icu4j/73.2/icu4j-73.2.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/authlib/6.0.54/authlib-6.0.54.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/blocklist/1.0.10/blocklist-1.0.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/brigadier/1.3.10/brigadier-1.3.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/datafixerupper/8.0.16/datafixerupper-8.0.16.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/logging/1.2.7/logging-1.2.7.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/patchy/2.2.10/patchy-2.2.10.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/text2speech/1.17.9/text2speech-1.17.9.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/commons-codec/commons-codec/1.16.0/commons-codec-1.16.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/commons-io/commons-io/2.15.1/commons-io-2.15.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/commons-logging/commons-logging/1.2/commons-logging-1.2.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-buffer/4.1.97.Final/netty-buffer-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-codec/4.1.97.Final/netty-codec-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-common/4.1.97.Final/netty-common-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-handler/4.1.97.Final/netty-handler-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-resolver/4.1.97.Final/netty-resolver-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-transport-classes-epoll/4.1.97.Final/netty-transport-classes-epoll-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-transport-native-unix-common/4.1.97.Final/netty-transport-native-unix-common-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/io/netty/netty-transport/4.1.97.Final/netty-transport-4.1.97.Final.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/it/unimi/dsi/fastutil/8.5.12/fastutil-8.5.12.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/java/dev/jna/jna-platform/5.14.0/jna-platform-5.14.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/java/dev/jna/jna/5.14.0/jna-5.14.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/sf/jopt-simple/jopt-simple/5.0.4/jopt-simple-5.0.4.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/commons/commons-compress/1.26.0/commons-compress-1.26.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/commons/commons-lang3/3.14.0/commons-lang3-3.14.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/httpcomponents/httpclient/4.5.13/httpclient-4.5.13.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/httpcomponents/httpcore/4.4.16/httpcore-4.4.16.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/logging/log4j/log4j-api/2.22.1/log4j-api-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/logging/log4j/log4j-core/2.22.1/log4j-core-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/apache/logging/log4j/log4j-slf4j2-impl/2.22.1/log4j-slf4j2-impl-2.22.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/jcraft/jorbis/0.0.17/jorbis-0.0.17.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/joml/joml/1.10.5/joml-1.10.5.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/lz4/lz4-java/1.8.0/lz4-java-1.8.0.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/slf4j/slf4j-api/2.0.9/slf4j-api-2.0.9.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/fabricmc/intermediary/1.21.1/intermediary-1.21.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm/9.7.1/asm-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-analysis/9.7.1/asm-analysis-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-commons/9.7.1/asm-commons-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-tree/9.7.1/asm-tree-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/org/ow2/asm/asm-util/9.7.1/asm-util-9.7.1.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/fabricmc/sponge-mixin/0.15.4+mixin.0.8.7/sponge-mixin-0.15.4+mixin.0.8.7.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/net/fabricmc/fabric-loader/0.16.9/fabric-loader-0.16.9.jar;C:/Users/Admin/AppData/Roaming/PollyMC/libraries/com/mojang/minecraft/1.21.1/minecraft-1.21.1-client.jar org.prismlauncher.EntryPoint
        5⤵
        
        PID:7808
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:6776
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe" -Xms512m -Xmx4096m -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:8980
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\javaw.exe
        
        "C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_87843\javaw.exe" -jar C:/Users/Admin/AppData/Local/Programs/PollyMC/jars/JavaCheck.jar
        5⤵
        
        PID:6276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=10796 -childID 43 -isForBrowser -prefsHandle 5032 -prefMapHandle 5856 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d0d1b67-2a16-4979-aaa6-9b143f61f7a1} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=11508 -childID 44 -isForBrowser -prefsHandle 8908 -prefMapHandle 8156 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {71701c19-c201-495c-b2b8-7fe19a59fe18} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=8908 -childID 45 -isForBrowser -prefsHandle 10388 -prefMapHandle 11524 -prefsLen 28466 -prefMapSize 244658 -jsInitHandle 908 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b092de7f-709b-4746-94d1-1e3ea8b00fb0} 2532 "\\.\pipe\gecko-crash-server-pipe.2532" tab
    3⤵
    PID:6876
- - C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe
    "C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe"
    3⤵
    - Executes dropped EXE
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\jds241609593.tmp\jdk-21_windows-x64_bin.exe
      "C:\Users\Admin\AppData\Local\Temp\jds241609593.tmp\jdk-21_windows-x64_bin.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Windows\System32\msiexec.exe
        
        "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\LocalLow\Oracle\Java\jdk21.0.5_x64\jdk21.0.564.msi" WRAPPER=1
        5⤵
        Blocklisted process makes network request
        Enumerates connected drives
        Checks processor information in registry
        Suspicious use of FindShellTrayWindow
        
        PID:7964
- - C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe
    "C:\Users\Admin\Downloads\jdk-21_windows-x64_bin.exe"
    3⤵
    - Executes dropped EXE
    PID:5492
  - - C:\Users\Admin\AppData\Local\Temp\jds241610890.tmp\jdk-21_windows-x64_bin.exe
      "C:\Users\Admin\AppData\Local\Temp\jds241610890.tmp\jdk-21_windows-x64_bin.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5416

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308 0x4fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6000

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:3532
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDc0NDMxNEYtNUIxNC00NEZCLTk5QkMtNDgyQkU3NTU0QzY0fSIgdXNlcmlkPSJ7MUY5OEUwRjEtMkRBOS00QzU2LUEwRjEtOTgwMzAxMEVFMTFCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QTUwRjBDOUMtQkEyRi00RjQzLUE1OTMtQUJGM0M4NTE2MTdDfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2xoVmkxMlFjazZTbDB1VTFPQjZZMTUyOWJSNmJzZXk0K2N1N2RIeHM2Y2s9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0MiIgaW5zdGFsbGRhdGV0aW1lPSIxNzI4MjkzNTMzIiBvb2JlX2luc3RhbGxfdGltZT0iMTMzNzI3NjYxMjM4MDMwMDAwIj48ZXZlbnQgZXZlbnR0eXBlPSIzMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMjE3OTg2MiIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzE4NDM2NzIyNSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5752
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\MicrosoftEdge_X64_131.0.2903.51.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
  2⤵
  - Executes dropped EXE
  PID:1720
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\EDGEMITMP_46517.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\EDGEMITMP_46517.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Drops file in Program Files directory
    PID:2520
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\EDGEMITMP_46517.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\EDGEMITMP_46517.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{BB4AF4AE-400E-4942-AF66-7A8FDB459F74}\EDGEMITMP_46517.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x21c,0x220,0x224,0x200,0x228,0x7ff6dee32918,0x7ff6dee32924,0x7ff6dee32930
      4⤵
      Executes dropped EXE
      PID:3504
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MDc0NDMxNEYtNUIxNC00NEZCLTk5QkMtNDgyQkU3NTU0QzY0fSIgdXNlcmlkPSJ7MUY5OEUwRjEtMkRBOS00QzU2LUEwRjEtOTgwMzAxMEVFMTFCfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins5OEQ2RTA2MS0wQ0Y0LTQ2OTEtQTIyNS0wNkFDNTM2MjZBMUN9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7VlBRb1AxRitmcTE1d1J6aDFrUEw0UE1wV2g4T1JNQjVpenZyT0MvY2hqUT0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjMwMTcyMjYtRkUyQS00Mjk1LThCREYtMDBDM0E5QTdFNEM1fSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMTMxLjAuMjkwMy41MSIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iOSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iNzE5NjM2NzEzMiIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIvPjxldmVudCBldmVudHR5cGU9IjUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjcxOTY0MTcxNDgiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDI3MzgxMzgzIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJiaXRzIiB1cmw9Imh0dHA6Ly9tc2VkZ2UuZi50bHUuZGwuZGVsaXZlcnkubXAubWljcm9zb2Z0LmNvbS9maWxlc3RyZWFtaW5nc2VydmljZS9maWxlcy8yNmQzOWY5Yi0wMmUxLTRlMjctODRlMi1iNTRiMjRkYzY4M2U_UDE9MTczMjYwNTg1MyZhbXA7UDI9NDA0JmFtcDtQMz0yJmFtcDtQND1KM1BEUEhqRzJhNTZrblR1NkFTbm9zWmhIeHBhcWFnclB4VnY3Rko5eU9kNmllbEhaJTJmU2FjZU1VUVZyVDBKWXhpQ1E3Q01VTVRsVjlFMjdmV3c0WmRRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTc2NjA3ODI0IiB0b3RhbD0iMTc2NjA3ODI0IiBkb3dubG9hZF90aW1lX21zPSIxNjM2MiIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijc0Mjc1MzI0MDUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI3NDQyNzc5MjcyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MDY3NjI3NzcwIiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iODg4IiBkb3dubG9hZF90aW1lX21zPSIyMzEwNyIgZG93bmxvYWRlZD0iMTc2NjA3ODI0IiB0b3RhbD0iMTc2NjA3ODI0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2MjQ3NCIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2396

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\MinecraftInstaller.msi"
1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5336

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B0F45FD0ED651E8F364A5ADF1457EB4E C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2756
- - C:\Program Files (x86)\Minecraft Launcher\MinecraftLauncher.exe
    "C:\Program Files (x86)\Minecraft Launcher\MinecraftLauncher.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6816
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:6232
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BC3DEF8C8660EFED25A45EF7682B8A8D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5291FA49C7B3F37A17F174CCC529AA1F E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:6456

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:5168

C:\Program Files\Modrinth App\Modrinth App.exe
"C:\Program Files\Modrinth App\Modrinth App.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
PID:5584
- C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=5584.6952.2121894061877674683
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks system information in the registry
  - Checks SCSI registry key(s)
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - System policy modification
  PID:6956
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=131.0.2903.51 --initial-client-data=0x178,0x17c,0x180,0x154,0x188,0x7ffd30466070,0x7ffd3046607c,0x7ffd30466088
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1076
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=gpu-process --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1868,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1864 /prefetch:2
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7132
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=1896,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4996
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --field-trial-handle=2332,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2004
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=3524,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:5724
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=4688,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:6080
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=renderer --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --field-trial-handle=5376,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    PID:7444
- - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe
    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\131.0.2903.51\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations=is-enterprise-managed=no --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\ModrinthApp\EBWebView" --webview-exe-name="Modrinth App.exe" --webview-exe-version=0.8.9 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2644,i,5014934193187513009,6835440681901343764,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:8
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:8940
- C:\Users\Admin\AppData\Roaming\ModrinthApp\meta\java_versions\zulu21.38.21-ca-jre21.0.5-win_x64\bin\javaw.exe
  "C:\Users\Admin\AppData\Roaming\ModrinthApp\meta\java_versions\zulu21.38.21-ca-jre21.0.5-win_x64\bin\javaw.exe" -cp C:\Users\Admin\AppData\Local\Temp\.tmpLQz7AV JavaInfo
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  PID:8156

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7632

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:7916

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7468
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1D687C63-D2FA-4419-9AF8-9B0EF45A1D27}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{1D687C63-D2FA-4419-9AF8-9B0EF45A1D27}\MicrosoftEdgeUpdateSetup_X86_1.3.195.35.exe" /update /sessionid "{C51F1B99-12E4-4263-B63B-7238242FC9F2}"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  PID:7640
- - C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\Temp\EU289B.tmp\MicrosoftEdgeUpdate.exe" /update /sessionid "{C51F1B99-12E4-4263-B63B-7238242FC9F2}"
    3⤵
    - Event Triggered Execution: Image File Execution Options Injection
    - Executes dropped EXE
    - Checks system information in the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:7608
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6100
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:1856
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:692
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6552
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.195.35\MicrosoftEdgeUpdateComRegisterShell64.exe"
        5⤵
        Executes dropped EXE
        Modifies registry class
        
        PID:6376
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzUxRjFCOTktMTJFNC00MjYzLUI2M0ItNzIzODI0MkZDOUYyfSIgdXNlcmlkPSJ7MUY5OEUwRjEtMkRBOS00QzU2LUEwRjEtOTgwMzAxMEVFMTFCfSIgaW5zdGFsbHNvdXJjZT0ic2VsZnVwZGF0ZSIgcmVxdWVzdGlkPSJ7MDY2MzAxQjMtNzEwMS00QTI2LUI5QTQtMDQ2OUZERDMyRjkwfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjgiIHBoeXNtZW1vcnk9IjgiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O2xoVmkxMlFjazZTbDB1VTFPQjZZMTUyOWJSNmJzZXk0K2N1N2RIeHM2Y2s9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xOTUuMzEiIG5leHR2ZXJzaW9uPSIxLjMuMTk1LjM1IiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgaW5zdGFsbGFnZT0iMCIgaW5zdGFsbGRhdGV0aW1lPSIxNzMyMDAxMDUwIj48ZXZlbnQgZXZlbnR0eXBlPSIzIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxMDQxMzkwMjg5NCIvPjwvYXBwPjwvcmVxdWVzdD4
      4⤵
      Executes dropped EXE
      Checks system information in the registry
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      PID:4184
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzEiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7QzUxRjFCOTktMTJFNC00MjYzLUI2M0ItNzIzODI0MkZDOUYyfSIgdXNlcmlkPSJ7MUY5OEUwRjEtMkRBOS00QzU2LUEwRjEtOTgwMzAxMEVFMTFCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins0M0Y4OUIzOS02MDYzLTQ1ODAtOTRGNy05NTc1NkIyNTMwODJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4zMSIgbmV4dHZlcnNpb249IjEuMy4xOTUuMzUiIGxhbmc9IiIgYnJhbmQ9IklOQlgiIGNsaWVudD0iIiBleHBlcmltZW50cz0iSXNPbkludGVydmFsQ29tbWFuZHNBbGxvd2VkPSU1QiUyMi10YXJnZXRfZGV2JTIwLW1pbl9icm93c2VyX3ZlcnNpb25fY2FuYXJ5X2RldiUyMDEzMS4wLjI4NzEuMCUyMiU1RCIgaW5zdGFsbGFnZT0iMCI-PHVwZGF0ZWNoZWNrLz48ZXZlbnQgZXZlbnR0eXBlPSIxMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzNTEwMzIyMDUiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzNTEwNzIxNjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjAiIGVycm9yY29kZT0iLTIxNDcwMjM4MzgiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMzcxMTAyMTQ5IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiBkb3dubG9hZGVyPSJkbyIgdXJsPSJodHRwOi8vbXNlZGdlLmIudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvNjhkNTc3YTAtMWY0YS00MzRmLWJkY2UtMTQ4ZWRjMWU0YTQwP1AxPTE3MzI2MDYxNjkmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9RWVBNU9oT3BIaTl0N1NOS0txUU80Q3poNEpranZSUFVGSDgzWE5EOW1kUSUyZjRVeEFDT2FEeWklMmI4d3QwZjZ3Q2Z0UkNZZE5JWnRUb2V5UjdPY0FYMEJRJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMCIgdG90YWw9IjAiIGRvd25sb2FkX3RpbWVfbXM9IjMiLz48ZXZlbnQgZXZlbnR0eXBlPSIxNCIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iMTAzNzExMTIxODUiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cDovL21zZWRnZS5iLnRsdS5kbC5kZWxpdmVyeS5tcC5taWNyb3NvZnQuY29tL2ZpbGVzdHJlYW1pbmdzZXJ2aWNlL2ZpbGVzLzY4ZDU3N2EwLTFmNGEtNDM0Zi1iZGNlLTE0OGVkYzFlNGE0MD9QMT0xNzMyNjA2MTY5JmFtcDtQMj00MDQmYW1wO1AzPTImYW1wO1A0PUVlQTVPaE9wSGk5dDdTTktLcVFPNEN6aDRKa2p2UlBVRkg4M1hORDltZFElMmY0VXhBQ09hRHlpJTJiOHd0MGY2d0NmdFJDWWROSVp0VG9leVI3T2NBWDBCUSUzZCUzZCIgc2VydmVyX2lwX2hpbnQ9IiIgY2RuX2NpZD0iLTEiIGNkbl9jY2M9IiIgY2RuX21zZWRnZV9yZWY9IiIgY2RuX2F6dXJlX3JlZl9vcmlnaW5fc2hpZWxkPSIiIGNkbl9jYWNoZT0iIiBjZG5fcDNwPSIiIGRvd25sb2FkZWQ9IjE2MzU5MjAiIHRvdGFsPSIxNjM1OTIwIiBkb3dubG9hZF90aW1lX21zPSIxOTE0Ii8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMzcxMTMyMjQ2IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEwMzc2MzkyNjc5IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PHBpbmcgcj0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9Ins1NkVCMThGOC1CMDA4LTRDQkQtQjZEMi04Qzk3RkU3RTkwNjJ9IiB2ZXJzaW9uPSI5Mi4wLjkwMi42NyIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpc19waW5uZWRfc3lzdGVtPSJ0cnVlIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzI3NzE4NzUyMzUzMTkwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzEuMC4yOTAzLjUxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NTMxIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzY0NzQ3NjQzNzM3NzcwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMSIgYT0iLTEiIHI9Ii0xIiBhZD0iLTEiIHJkPSItMSIgcGluZ19mcmVzaG5lc3M9Ins1MURCMjQ2OC1CRjdFLTQ1OUUtODU0RC0xOTY0MjE3MDNENER9Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1100

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1612

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Checks system information in the registry
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7876
- C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\MicrosoftEdge_X64_131.0.2903.51.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
  2⤵
  - Executes dropped EXE
  PID:1484
- - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\MicrosoftEdge_X64_131.0.2903.51.exe" --msedge --verbose-logging --do-not-launch-msedge --system-level --channel=stable
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Installs/modifies Browser Helper Object
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - System policy modification
    PID:7916
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x1f4,0x1e8,0x1e4,0x1e0,0x210,0x7ff7877d2918,0x7ff7877d2924,0x7ff7877d2930
      4⤵
      Executes dropped EXE
      PID:5952
  - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe
      "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe" --msedge --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=1
      4⤵
      Executes dropped EXE
      Drops file in System32 directory
      Drops file in Program Files directory
      Modifies data under HKEY_USERS
      PID:1996
    - - C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{CFE880BE-F3A4-4042-A1D9-9DB929CB75F2}\EDGEMITMP_88835.tmp\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x1ec,0x234,0x238,0x1f4,0x23c,0x7ff7877d2918,0x7ff7877d2924,0x7ff7877d2930
        5⤵
        Executes dropped EXE
        
        PID:7620
  - - C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --msedge --channel=stable --register-package-identity --verbose-logging --system-level
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6284
    - - C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7b6652918,0x7ff7b6652924,0x7ff7b6652930
        5⤵
        Executes dropped EXE
        
        PID:6696
  - - C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --msedge --channel=stable --remove-deprecated-packages --verbose-logging --system-level
      4⤵
      Executes dropped EXE
      PID:8060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x224,0x228,0x22c,0x200,0x230,0x7ff7b6652918,0x7ff7b6652924,0x7ff7b6652930
        5⤵
        Executes dropped EXE
        Drops file in Program Files directory
        
        PID:2488
  - - C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --msedge --channel=stable --update-game-assist-package --verbose-logging --system-level
      4⤵
      Executes dropped EXE
      PID:1308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=131.0.6778.70 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\131.0.2903.51\Installer\setup.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=131.0.2903.51 --initial-client-data=0x228,0x22c,0x230,0x200,0x234,0x7ff7b6652918,0x7ff7b6652924,0x7ff7b6652930
        5⤵
        Executes dropped EXE
        
        PID:5440
- C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
  "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuMzUiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuMzEiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7N0E4NDk1QkQtQTQ1NC00NkY1LTgyOTEtNjRFQzRBNUQxNThFfSIgdXNlcmlkPSJ7MUY5OEUwRjEtMkRBOS00QzU2LUEwRjEtOTgwMzAxMEVFMTFCfSIgaW5zdGFsbHNvdXJjZT0ic2NoZWR1bGVyIiByZXF1ZXN0aWQ9Ins4QUNDNkY2RS01N0RCLTRFN0YtOUE0OS01RjQyRTZFRTNFMTl9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIiBpc19pbl9sb2NrZG93bl9tb2RlPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iIiBwcm9kdWN0X25hbWU9IiIvPjxleHAgZXRhZz0iJnF1b3Q7bGhWaTEyUWNrNlNsMHVVMU9CNlkxNTI5YlI2YnNleTQrY3U3ZEh4czZjaz0mcXVvdDsiLz48YXBwIGFwcGlkPSJ7RjNDNEZFMDAtRUZENS00MDNCLTk1NjktMzk4QTIwRjFCQTRBfSIgdmVyc2lvbj0iMS4zLjE5NS4zNSIgbmV4dHZlcnNpb249IiIgbGFuZz0iIiBicmFuZD0iSU5CWCIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJJc09uSW50ZXJ2YWxDb21tYW5kc0FsbG93ZWQ9JTVCJTIyLXRhcmdldF9kZXYlMjAtbWluX2Jyb3dzZXJfdmVyc2lvbl9jYW5hcnlfZGV2JTIwMTMxLjAuMjg3MS4wJTIyJTVEIiBpbnN0YWxsYWdlPSIwIiBjb2hvcnQ9InJyZkAwLjk3Ij48dXBkYXRlY2hlY2svPjxwaW5nIHJkPSI2NTMyIiBwaW5nX2ZyZXNobmVzcz0iezcxREI0RERCLTAyRTItNEI2My1CODQyLTkwMTQyREJDRDFFOX0iLz48L2FwcD48YXBwIGFwcGlkPSJ7NTZFQjE4RjgtQjAwOC00Q0JELUI2RDItOEM5N0ZFN0U5MDYyfSIgdmVyc2lvbj0iOTIuMC45MDIuNjciIG5leHR2ZXJzaW9uPSIxMzEuMC4yOTAzLjUxIiBsYW5nPSIiIGJyYW5kPSJJTkJYIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGlzX3Bpbm5lZF9zeXN0ZW09InRydWUiIGxhc3RfbGF1bmNoX2NvdW50PSIxIiBsYXN0X2xhdW5jaF90aW1lPSIxMzM3Mjc3MTg3NTIzNTMxOTAiPjx1cGRhdGVjaGVjay8-PGV2ZW50IGV2ZW50dHlwZT0iMTIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNzU3NzI5OTc0IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTMiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNzU3NzgwNDA3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTQiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzNzg4NTc5ODUyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMTUiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjEzODAzMDI4MjcxIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMyIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSIxNDM1ODc0NzQyNSIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgdXBkYXRlX2NoZWNrX3RpbWVfbXM9IjkxMCIgZG93bmxvYWRlZD0iMTc2NjA3ODI0IiB0b3RhbD0iMTc2NjA3ODI0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMiIgaW5zdGFsbF90aW1lX21zPSI1NTU2NSIvPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjY1MzIiIHBpbmdfZnJlc2huZXNzPSJ7OUMzOUNCRTItNzJBNS00RTk4LUE0MkQtNzU4RjhBQjU2NzkyfSIvPjwvYXBwPjxhcHAgYXBwaWQ9IntGMzAxNzIyNi1GRTJBLTQyOTUtOEJERi0wMEMzQTlBN0U0QzV9IiB2ZXJzaW9uPSIxMzEuMC4yOTAzLjUxIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSIiIGJyYW5kPSJHR0xTIiBjbGllbnQ9IiIgZXhwZXJpbWVudHM9ImNvbnNlbnQ9ZmFsc2UiIGluc3RhbGxhZ2U9IjAiIGluc3RhbGxkYXRlPSI2NTMxIiBjb2hvcnQ9InJyZkAwLjQyIiBsYXN0X2xhdW5jaF9jb3VudD0iMSIgbGFzdF9sYXVuY2hfdGltZT0iMTMzNzY0NzQ3NjQzNzM3NzcwIj48dXBkYXRlY2hlY2svPjxwaW5nIGFjdGl2ZT0iMCIgcmQ9IjY1MzIiIHBpbmdfZnJlc2huZXNzPSJ7ODM0NUJDRTgtMzlGRS00NzM4LTg2QUItNDA1MzAwMzZGRkJGfSIvPjwvYXBwPjwvcmVxdWVzdD4
  2⤵
  - Executes dropped EXE
  - Checks system information in the registry
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:7908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness
1⤵
PID:6888

C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe
"C:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_18.1903.1152.0_x64__8wekyb3d8bbwe\LocalBridge.exe" /InvokerPRAID: Microsoft.MicrosoftOfficeHub prelaunch
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5316

C:\Windows\system32\wwahost.exe
"C:\Windows\system32\wwahost.exe" -ServerName:Microsoft.MicrosoftOfficeHub.wwa
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:8128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:7564
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding A4D21814625F59FCD55A98D78769DB2B C
  2⤵
  PID:2324
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 9BA60425D17221F75CFB85EDD3D14165
  2⤵
  PID:7720
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding B28EBB542FD7252CD1D22117C0AC5CA0 E Global\MSI0000
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies data under HKEY_USERS
  PID:5056

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\9e02cca7919a4547bd20f24aa9a3ec68 /t 5808 /p 5584
1⤵
PID:6444

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6148

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:9056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery