Resubmissions
20/07/2026, 16:48
260720-vbjwbsgw3q1007/07/2026, 22:38
260707-2kndfaf13j807/07/2026, 22:38
260707-2km3nsf12r27/06/2026, 18:29
260627-w4ww2acx2w1027/06/2026, 17:09
260627-vn7sxscv5m827/06/2026, 10:22
260627-mefn3say2q927/06/2026, 08:46
260627-kn9meahw9x827/06/2026, 01:27
260627-bt8smagz6r826/06/2026, 14:29
260626-rt2x3sb19s826/06/2026, 13:41
260626-qy8ezsby218Analysis
- user interaction
yes - max time kernel
1747s - max time network
1805s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
17/04/2026, 15:28
General
- Target 82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe
- Size 7.5MB
- Sample260417-swee8sbs2k
- SHA256 d2a7b55fd4a1114751f1fcd2b55366d37e5dab9621f2c5428ec95997e57878a1
Score
10/10
Malware Config
Signatures
- Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
- Modifies visibility of hidden/system files in Explorer 2 TTPs 1 IoCs
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Modifies RDP port number used by Windows 1 TTPs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Adds Run key to start application 2 TTPs 4 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Contacts third-party web service commonly abused for C2 1 TTPs 11 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in System32 directory 18 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks system information in the registry 2 TTPs 6 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 28 IoCs
- Launches sc.exe 37 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 9 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 25 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 6 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 54 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 14 IoCs
- Modifies Internet Explorer settings 1 TTPs 31 IoCs
- Modifies data under HKEY_USERS 47 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 9 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 9 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 26 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe" --local-service2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe" --backend3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe"C:\Users\Admin\AppData\Local\Temp\82a9f04020f80b10bce7d17d1591c241d62aa982b375851d7e809c444f2023b6.exe" --local-control2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004EC1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "-Command" "if((Get-ExecutionPolicy ) -ne 'AllSigned') { Set-ExecutionPolicy -Scope Process Bypass }; & 'C:\Users\Admin\Desktop\Setup.ps1'"1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4j0e0y4d\4j0e0y4d.cmdline"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1294.tmp" "c:\Users\Admin\AppData\Local\Temp\4j0e0y4d\CSC9B0125DADC4B4764874282CFCC564BD.TMP"3⤵
-
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "echo CMD is working"2⤵
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c ""C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd" -el "2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null3⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"3⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd"3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el" "3⤵
-
-
C:\Windows\System32\find.exefind /i "/"3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver3⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV23⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "3⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "4⤵
-
-
C:\Windows\System32\cmd.execmd4⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd" "3⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"3⤵
-
-
C:\Windows\System32\fltMC.exefltmc3⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mode.commode con4⤵
-
-
-
C:\Windows\System32\reg.exereg query HKCU\Console /v QuickEdit3⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "0x0"3⤵
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 0 /f3⤵
- Modifies registry key
-
-
C:\Windows\System32\cmd.execmd.exe /c ""C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd" -el -qedit"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV24⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "4⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "5⤵
-
-
C:\Windows\System32\cmd.execmd5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd" "4⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"4⤵
-
-
C:\Windows\System32\fltMC.exefltmc4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mode.commode con5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 activated.win5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck310.activated.win4⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck310.activated.win5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/S"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "-el -qedit" "4⤵
-
-
C:\Windows\System32\find.exefind /i "/"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /v Desktop5⤵
-
-
-
C:\Windows\System32\mode.commode 76, 344⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\ClickToRun\Configuration /v ProductReleaseIds4⤵
- Modifies registry key
-
-
C:\Windows\System32\find.exefind /i "O365"4⤵
-
-
C:\Windows\System32\choice.exechoice /C:12345678EH0 /N4⤵
-
-
C:\Windows\System32\mode.commode 110, 344⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"4⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "4⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"4⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value5⤵
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "4⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"4⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net4⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net5⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s4⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"4⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts4⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "4⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"4⤵
-
-
C:\Windows\System32\sc.exesc query Null4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState5⤵
-
-
-
C:\Windows\System32\sc.exesc start ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath4⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type4⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager4⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"4⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt4⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value4⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version4⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 04⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE5⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE5⤵
-
-
-
C:\Windows\System32\sc.exesc query wlms4⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"5⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "4⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f4⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Removed Not Found"4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul4⤵
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "040fa323-92b1-4baf-97a2-5b67feaefddb 0724cb7d-3437-4cb7-93cb-830375d0079d 0ad2ac98-7bb9-4201-8d92-312299201369 1a9a717a-cf13-4ba5-83c3-0fe25fa868d5 221a02da-e2a1-4b75-864c-0a4410a33fdf 291ece0e-9c38-40ca-a9e1-32cc7ec19507 2936d1d2-913a-4542-b54e-ce5a602a2a38 2c293c26-a45a-4a2a-a350-c69a67097529 2de67392-b7a7-462a-b1ca-108dd189f588 2ffd8952-423e-4903-b993-72a1aa44cf82 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 345a5db0-d94f-4e3b-a0c0-7c42f7bc3ebf 3502365a-f88a-4ba4-822a-5769d3073b65 377333b1-8b5d-48d6-9679-1225c872d37c 3df374ef-d444-4494-a5a1-4b0d9fd0e203 3f1afc82-f8ac-4f6c-8005-1d233e606eee 49cd895b-53b2-4dc4-a5f7-b18aa019ad37 4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c 4f3da0d2-271d-4508-ae81-626b60809a38 5d78c4e9-aeb3-4b40-8ac2-6a6005e0ad6d 60b3ec1b-9545-4921-821f-311b129dd6f6 613d217f-7f13-4268-9907-1662339531cd 62f0c100-9c53-4e02-b886-a3528ddfe7f6 6365275e-368d-46ca-a0ef-fc0404119333 721f9237-9341-4453-a661-09e8baa6cca5 73111121-5638-40f6-bc11-f1d7b0d64300 7a802526-4c94-4bd1-ba14-835a1aca2120 7cb546c0-c7d5-44d8-9a5c-69ecdd782b69 82bbc092-bc50-4e16-8e18-b74fc486aec3 8ab9bdd1-1f67-4997-82d9-8878520837d9 8b351c9c-f398-4515-9900-09df49427262 90da7373-1c51-430b-bf26-c97e9c5cdc31 92fb8726-92a8-4ffc-94ce-f82e07444653 95dca82f-385d-4d39-b85b-5c73fa285d6f a48938aa-62fa-4966-9d44-9f04da3f72f2 b0773a15-df3a-4312-9ad2-83d69648e356 b4bfe195-541e-4e64-ad23-6177f19e395e b68e61d2-68ca-4757-be45-0cc2f3e68eee bd3762d7-270d-4760-8fb3-d829ca45278a c86d5194-4840-4dae-9c1c-0301003a5ab0 ca7df2e3-5ea0-47b8-9ac1-b1be4d8edd69 d552befb-48cc-4327-8f39-47d2d94f987c d6eadb3b-5ca8-4a6b-986e-35b550756111 df96023b-dcd9-4be2-afa0-c6c871159ebe e0c42288-980c-4788-a014-c080d2e1926e e4db50ea-bda1-4566-b047-0ca50abc6f07 e558417a-5123-4f6f-91e7-385c1c7ca9d4 e7a950a2-e548-4f10-bf16-02ec848e0643 eb6d346f-1c60-4643-b960-40ec31596c45 ec868e65-fadf-4759-b23e-93fe37f2cc29 ef51e000-2659-4f25-8345-3de70a9cf4c4 f7af7d09-40e4-419c-a49b-eae366689ebd fa755fe6-6739-40b9-8d84-6d0ea3b6d1ab fe74f55b-0338-41d6-b267-4a201abe7285 " "4⤵
-
-
C:\Windows\System32\find.exefind /i "4de7cb65-cdf1-4de9-8ae8-e3cce27b9f2c"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="VK7JG-NPHTM-C97JM-9MPGT-3V66T"4⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 04⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus4⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name5⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul4⤵
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation5⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[System.IO.File]::ReadAllText('C:\Windows\Temp\MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"4⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\ClipUp.execlipup -v -o4⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\tem51BB.tmp5⤵
- Checks SCSI registry key(s)
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"4⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 Pro" "4⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"4⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate4⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 04⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value4⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f4⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"4⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile5⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\choice.exechoice /C:10 /N4⤵
-
-
-
C:\Windows\System32\reg.exereg add HKCU\Console /v QuickEdit /t REG_DWORD /d 1 /f3⤵
- Modifies registry key
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" panel2⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb553ec728,0x7ffb553ec734,0x7ffb553ec7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,3696573974537494285,4121285763540009523,262144 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1916 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2232,i,12281682604772514055,5446693089888752123,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2236 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,6410515616410726310,3919211345639516136,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2380 /prefetch:133⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,12928597632016187387,8532452537328549773,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3436 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3228,i,5646776808337446395,15863775418572873930,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3456 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4220,i,18281966606119945147,8999885593662731366,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4228 /prefetch:93⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4548,i,16112326120520842538,7020402979691419697,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4628 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,13241119845818989930,16652831280063063615,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5396 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5656,i,1195551930053205178,645122422293450083,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5680 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3652,i,367044049015527976,11413622648187726441,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3392 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3600,i,13743322665990566526,12916620623854380826,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3548 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6032,i,15817618197142745108,6691159082954026567,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6044 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3532,i,1421194796110705007,13582201941305544631,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5572 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3508,i,5974529653527503582,2952776798529036490,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3424 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3576,i,1013141990177459208,7514152391040519414,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5940 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6216,i,16367958732448038750,5943899893902341975,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6184 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6232,i,6038306111490726012,17068690792957011289,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6348 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6492,i,16701334157454031880,17332846498610263007,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6528 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6704,i,10955158934622708758,14122011471852425826,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6708 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6828,i,8608764096939077967,198554826226722526,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6916 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6924,i,12410293078974307241,1765857437105382012,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6888 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6248,i,15789071308894839726,14530851942485919730,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6536 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7116,i,7186686204287592263,4449525092537009141,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=7140 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3688,i,5717839905168662152,2074341723717290160,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6384 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,8377725108600639146,12419170247840800344,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3428 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6448,i,13835552089106162870,16521353299120345270,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6436 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4220,i,12553865471587328560,303676398578684528,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4204 /prefetch:143⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4352,i,9157643348823795680,13921113339663250198,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4220 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6356,i,3460833508547123883,10683012118020696639,2097152 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4496 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,8478473956736535452,13280569150463965274,524288 --field-trial-handle=1912,i,12321381126876397068,8876009116704561295,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=6488 /prefetch:143⤵
-
-
-
C:\Users\Admin\Downloads\Discord\DiscordSetup.exe"C:\Users\Admin\Downloads\Discord\DiscordSetup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --squirrel-install 1.0.92334⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9233 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x50c,0x510,0x514,0x504,0x518,0x7ff7d4b2c074,0x7ff7d4b2c080,0x7ff7d4b2c0905⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exeC:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1904,i,7370301503604416112,45623173102250001,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1904,i,7370301503604416112,45623173102250001,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:115⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\",-1" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\" --url -- \"%1\"" /f5⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --squirrel-firstrun4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9233 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4fc,0x500,0x504,0x4f4,0x508,0x7ff7d4b2c074,0x7ff7d4b2c080,0x7ff7d4b2c0905⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:115⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f5⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1776439219088971 --launch-time-ticks=881408348 --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\",-1" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\" --url -- \"%1\"" /f5⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1776439219088971 --launch-time-ticks=888601226 --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3976 --enable-node-leakage-in-renderers /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --time-ticks-at-unix-epoch=-1776439219088971 --launch-time-ticks=888823438 --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4116 --enable-node-leakage-in-renderers /prefetch:15⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd6⤵
- Executes dropped EXE
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:145⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:125⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=48034215-c441-4603-a605-21ebf43f4bdd5⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x368,0x7ffb4e87c188,0x7ffb4e87c194,0x7ffb4e87c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,11076028508201837036,1261368018329783911,524288 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:116⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1616,i,16513091581816539339,14843211295286597768,262144 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,3473250795654283133,13345004046680829634,524288 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,18332691780050436017,3311712844315682060,2097152 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,849810090761633093,10578443811613224480,2097152 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,16578549245585774588,4238517997667311070,524288 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5084,i,1611966226104953389,8169250937290210861,2097152 --field-trial-handle=2536,i,492087090623571221,10516567480098580006,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window6⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x214,0x7ffb4e87c188,0x7ffb4e87c194,0x7ffb4e87c1a07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,16556373997461021375,15491271203502053071,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:117⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1504,i,3060399129349713874,9445219462338575172,262144 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,559031302354455245,14115133538120496219,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:137⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,4222203276768233383,2125278999241654198,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,4222203276768233383,2125278999241654198,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,10091492433150450787,17415186447043662790,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,5264557010073815196,4262105694168650326,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,8602129891267365504,2142927639726687671,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,12982478765867289457,11557599508578372286,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,5118844300571507753,3453171108434857459,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4728,i,2546100968211887838,14989743314821150296,2097152 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4804,i,8310589365489635536,9960008606364057618,2097152 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,3938498628787207455,15733655703513738694,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,5257441805508569275,12495626332216490455,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,2715756815294265251,16111228158627401227,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6020,i,12375710949397397695,1557476055353326027,2097152 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,18065203379346230721,701680007496526348,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,16955986238020833107,14283798682727793486,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,16955986238020833107,14283798682727793486,524288 --field-trial-handle=2012,i,5510917233527392643,1731399318429178493,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window7⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb4e87c188,0x7ffb4e87c194,0x7ffb4e87c1a08⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,12528485339281060197,1474278999739853689,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:118⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,16382045275266804028,18193791703949134266,262144 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:28⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2076,i,13751905634748604693,6904383498200212698,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:138⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,6301075337938871834,6910786804092407229,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,6301075337938871834,6910786804092407229,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,9536164291122538457,4058310135181965630,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4832,i,16478003100759466950,18240688073948015564,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,5801194036850525733,1387932479373354819,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,16033014693364220741,2554614047799937675,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,11831845372307710001,14333786181550262405,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3216,i,13420282977163100769,12285940919580761180,262144 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:108⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,1141963823877609028,2379800014128819913,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,16787911525085857351,11032616610298860729,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=3880 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3156,i,7679566240447738073,14411159412197283984,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5028,i,5731622923835243841,1975962250498823558,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,8791562972696356306,15243319617556248979,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,6333900556754749385,12331790603521971769,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,9056461801681663637,15544589364557658419,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,11558118097311913118,11540283758712316374,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,6206063830986144144,12751637937181288372,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,13946147848973027170,5392386562873072050,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,14834327016594971530,7132362036915072487,524288 --field-trial-handle=2700,i,9637649365101105465,4825368622747773058,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:148⤵
-
-
-
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord5⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2032,i,6336894400109330766,15156697144377109937,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:105⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1413202914071285771/1494477604810657852/aed8bef80f4ae3e4.mp3?ex=69e368fb&is=69e2177b&hm=386701d33a5e4b9e4e7bfe093c3d9d7fa7a189d28ead7313f0a167b4713ddd1a&5⤵
-
-
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\FreeMic\FreeMic\Softwares\Soundpad_x64-4.0.30.msi"2⤵
- Enumerates connected drives
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /02⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
-
-
C:\Program Files\Soundpad\Soundpad.exe"C:\Program Files\Soundpad\Soundpad.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Soundpad\SoundpadService.exe"C:\Program Files\Soundpad\SoundpadService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" panel2⤵
-
-
C:\Windows\system32\control.exe"C:\Windows\system32\control.exe" panel2⤵
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Windows\system32\SystemPropertiesPerformance.exe"C:\Windows\system32\SystemPropertiesPerformance.exe"2⤵
- Modifies visibility of file extensions in Explorer
- Modifies visibility of hidden/system files in Explorer
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\tem50D1.tmp2⤵
- Checks SCSI registry key(s)
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2954BDA58376F1AD377A0B30BCA90E25 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Program Files\Soundpad\Soundpad.exe"C:\Program Files\Soundpad\Soundpad.exe" -i -s2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx1.8.0.dll"3⤵
- Loads dropped DLL
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\SpatialAudioLicenseSrv.exeC:\Windows\System32\SpatialAudioLicenseSrv.exe SpatialAudioLicenseServerInteractiveUser -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Drops file in System32 directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\mmsys.cpl2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\mmsys.cpl2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" ms-settings:display2⤵
-
-
C:\Windows\system32\DevicePairingWizard.exe"C:\Windows\system32\DevicePairingWizard.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"2⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart3⤵
- Checks system information in the registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode4⤵
- Adds Run key to start application
- Checks system information in the registry
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"5⤵
- Drops desktop.ini file(s)
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe/updateInstalled /background5⤵
- Checks system information in the registry
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
-
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"2⤵
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
-
C:\Windows\system32\dashost.exedashost.exe {cf9b2149-9099-4aae-8f8083604867d5f4}2⤵
-
-
C:\Windows\system32\dashost.exedashost.exe {a736dcba-f891-4d01-a4285f39b329e43d}2⤵
-
-
C:\Windows\system32\dashost.exedashost.exe {afcfd22c-e1db-439f-8c9ee7f68d5366f5}2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k McpManagementServiceGroup1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Windows\system32\SystemPropertiesComputerName.exe"C:\Windows\system32\SystemPropertiesComputerName.exe"2⤵
-
-
C:\Windows\system32\SystemPropertiesAdvanced.exe"C:\Windows\system32\SystemPropertiesAdvanced.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Windows\System32\sdclt.exe"C:\Windows\System32\sdclt.exe" /configure2⤵
- Enumerates connected drives
- Checks SCSI registry key(s)
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" RemoteDesktopTurnOnRdp1⤵
-
C:\Windows\system32\SystemSettingsAdminFlows.exe"C:\Windows\system32\SystemSettingsAdminFlows.exe" RemoteDesktopSelectUsers1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exe"C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\DllHost.exe"C:\Windows\SysWOW64\DllHost.exe" /Processid:{5250E46F-BB09-D602-5891-F476DC89B700}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Checks SCSI registry key(s)
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
8Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
7Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
$ITBA9VM.zip
e5da27d.rbs
translation.mo
GenuineTicket
dispatch.log
package.json
gpu_encoder_helper.exe
app.ico
0605c84141807bccfd1b422925981f5e026de93bad4d18c25be5a1efbca917a4
116d633a16227300a02dcdfa0e6f9b9e50d8f0746320a16dc6743f75e32604d0
290faeed98c5e136d4a54258c325f3c4a2c013a276d0a1f7d34b5b04d4238a70
4b5d6eb903e5331964a8ad25aee5cc0c83997dcd51cb6098a538b8b475bc7f6d
5513251e637bccf984559221fcbff060e360fd0aeaf0359a1a4e775d35b0d613
6228da4dcb99565ab0e3c7589ade69de21794476b4d0f9da9eddc80e83c71949
6e66eda3835488c4eb4ac57642ba99eca0fecdbeeb685a3400d0f4d06bfc3358
7a8b3a893dee115ab64fff9071e63a0d0aec135b57c3f8deee12160bb9a7e628
8a2578e64fb81eeffa1721807a24fe1643ed238dbccf00805a2bf50592dd0045
91650647a045dbf61daa9261e9dfd1ef95f3f80088e6064047b62291a262ea91
99fb715c10f466d26678649b4d0b993652cd4c65d42729d29a45a53b184106af
9cdabdcc03f82557dc6b56bf2977e6337f40961d2c635b9017ff200ad786650c
ac16de661f614102ec28d17e12cb6676d7e7b85929f4f1d2170614fefae16cbb
b6870de5650fedfddaa5d90a9556b819e62abb3d5660585ab82f9b22da5129be
d19d1957ebbe6a93c5834f32b069f63c327ffd096fa5e046a18654d9b8a01fff
df0eeee5ef974b62a917a659b1174cee2b331ef6d1fa32e9446cfa83280805ab
installer.db
installer.db
RELEASES
RELEASES
settings.dat
BookmarkMergedSurfaceOrdering
Bookmarks
Bookmarks~RFe5c5f9c.TMP
BrowsingTopicsState
the-real-index
data_1
Google Profile.ico
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe5bd80d.TMP
7789e33cdfd39524_0
the-real-index
Local State
Local State
Local State
Local State
Local State
powershell.exe.log
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
settings.dat
settings.dat
LOG.old
MANIFEST-000001
BrowsingTopicsState
f_0000a5
the-real-index
the-real-index~RFe5e2c5d.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
Preferences
Preferences
Secure Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe5e2885.TMP
sync_diagnostic.log
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
FileSyncConfig.exe
OneDriveMedTile.contrast-black_scale-100.png
OneDriveMedTile.contrast-black_scale-125.png
OneDriveMedTile.contrast-black_scale-150.png
OneDriveMedTile.contrast-black_scale-200.png
OneDriveMedTile.contrast-black_scale-400.png
OneDriveMedTile.contrast-white_scale-100.png
OneDriveMedTile.contrast-white_scale-125.png
OneDriveMedTile.contrast-white_scale-150.png
OneDriveMedTile.contrast-white_scale-200.png
OneDriveMedTile.contrast-white_scale-400.png
OneDriveMedTile.scale-100.png
OneDriveMedTile.scale-125.png
OneDriveMedTile.scale-150.png
OneDriveMedTile.scale-200.png
OneDriveMedTile.scale-400.png
OneDriveSmallTile.contrast-black_scale-100.png
OneDriveSmallTile.contrast-black_scale-125.png
OneDriveSmallTile.contrast-black_scale-150.png
OneDriveSmallTile.contrast-black_scale-200.png
OneDriveSmallTile.contrast-black_scale-400.png
OneDriveSmallTile.scale-100.png
OneDriveSmallTile.scale-125.png
OneDriveSmallTile.scale-150.png
OneDriveSmallTile.scale-200.png
OneDriveSmallTile.scale-400.png
OneDrive.VisualElementsManifest.xml
OneDrive.exe
OneDriveStandaloneUpdater.exe
Resources.pri
OneDriveSetup.exe
logUploaderSettings_temp.ini
logUploaderSettings_temp.ini
DeviceHealthSummaryConfiguration.ini
iconcache_idx.db
update100[1].xml
PreSignInSettingsConfig[1].json
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
microsoftwindows.client[1].xml
microsoftwindows.client[1].xml
microsoftwindows.client[1].xml
microsoftwindows.client[1].xml
Zrtu2hQ08VU_1.metadata
AppCache134209137781506382.txt
4j0e0y4d.dll
5b90637e-ad11-4227-bec3-26ff2ecd3576.tmp
RES1294.tmp
__PSScriptPolicyTest_qfbfvypg.fqu.ps1
gcapi.dll
tem51BB.tmp
tmpAC18.tmp
SP_878D8A46EF58405D99FDB93964784FEB.dat
ad.trace
ad.trace
service.conf
service.conf
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf.new
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
default.dic
All Tasks.lnk
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
CachedImage_1920_1080_POS4.jpg
f_000042
f_000058
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_2
data_3
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity~RFe73575f.TMP
ac242e3a-0fe8-4f02-925b-d78448107537.tmp
Preferences
index
the-real-index
the-real-index~RFe5f1bfd.TMP
the-real-index
the-real-index~RFe5ef26c.TMP
index.txt
index.txt
index.txt
index.txt~RFe5df0fa.TMP
CURRENT
MANIFEST-000001
dfed77b6-586d-4662-a6c8-10047ffc8b2a.tmp
renderer_js.log
renderer_js.log
settings.json
Setup.ps1
EqualizerAPO-x64-1.4.2.exe
Soundpad_x64-4.0.30.msi
manifest.json
keys.json
manifest.json
manifest.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
manifest.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
manifest.json
tem50D1.tmp
MAS_12a8daaf-275d-4ecc-8c0e-6698bfb3a7e1.cmd
4j0e0y4d.0.cs
4j0e0y4d.cmdline
CSC9B0125DADC4B4764874282CFCC564BD.TMP
memory/8-497-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-471-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-409-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-411-0x0000000004C60000-0x0000000004C6B000-memory.dmp
memory/8-439-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-412-0x00000000063A0000-0x00000000063AE000-memory.dmp
memory/8-410-0x0000000002EF0000-0x000000000309C000-memory.dmp
memory/8-32-0x0000000004AF0000-0x0000000004B79000-memory.dmp
memory/8-155-0x00000000067B0000-0x00000000067CB000-memory.dmp
memory/8-28-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-154-0x00000000067B0000-0x00000000067CB000-memory.dmp
memory/8-151-0x00000000067B0000-0x00000000067CB000-memory.dmp
memory/8-449-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-422-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-699-0x0000000000420000-0x0000000002713000-memory.dmp
memory/8-700-0x0000000002EF0000-0x000000000309C000-memory.dmp
memory/1312-2936-0x0000000005220000-0x0000000005240000-memory.dmp
memory/1660-703-0x0000000000420000-0x0000000002713000-memory.dmp
memory/1660-486-0x0000000000420000-0x0000000002713000-memory.dmp
memory/1660-501-0x0000000000420000-0x0000000002713000-memory.dmp
memory/1660-29-0x0000000000420000-0x0000000002713000-memory.dmp
memory/1660-34-0x0000000003020000-0x00000000030A9000-memory.dmp
memory/1660-414-0x0000000003100000-0x00000000032AC000-memory.dmp
memory/1660-443-0x0000000000420000-0x0000000002713000-memory.dmp
memory/1660-413-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2188-516-0x000001EFBA5F0000-0x000001EFBA60C000-memory.dmp
memory/2188-517-0x000001EFBA610000-0x000001EFBA6C3000-memory.dmp
memory/2188-508-0x000001EFBA270000-0x000001EFBA292000-memory.dmp
memory/2188-536-0x000001EFBA3C0000-0x000001EFBA3C8000-memory.dmp
memory/2188-519-0x000001EFBA840000-0x000001EFBA85C000-memory.dmp
memory/2188-537-0x000001EFBA9F0000-0x000001EFBABB2000-memory.dmp
memory/2188-578-0x000001EFA1BD0000-0x000001EFA1BE2000-memory.dmp
memory/2188-576-0x000001EFA0210000-0x000001EFA026D000-memory.dmp
memory/2188-518-0x000001EFBA3D0000-0x000001EFBA3DA000-memory.dmp
memory/2188-577-0x000001EFA1B50000-0x000001EFA1B5C000-memory.dmp
memory/2428-534-0x000001CC72C80000-0x000001CC72C8C000-memory.dmp
memory/2428-533-0x000001CC72B60000-0x000001CC72BBD000-memory.dmp
memory/2660-875-0x00000240404F0000-0x00000240405A3000-memory.dmp
memory/2796-445-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-435-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-579-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-733-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-418-0x0000000004A90000-0x0000000004B19000-memory.dmp
memory/2796-416-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-467-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-491-0x0000000000420000-0x0000000002713000-memory.dmp
memory/2796-436-0x0000000002FD0000-0x000000000317C000-memory.dmp
memory/3396-644-0x00000225A7E60000-0x00000225A7E80000-memory.dmp
memory/3396-622-0x00000225A7E40000-0x00000225A7E60000-memory.dmp
memory/3396-605-0x00000225A73C0000-0x00000225A73E0000-memory.dmp
memory/3396-584-0x0000022594940000-0x0000022594A40000-memory.dmp
memory/3396-626-0x00000225A7EE0000-0x00000225A7F00000-memory.dmp
memory/3396-585-0x0000022594940000-0x0000022594A40000-memory.dmp
memory/3396-583-0x0000022594940000-0x0000022594A40000-memory.dmp
memory/3396-590-0x0000022594780000-0x0000022594880000-memory.dmp
memory/3416-927-0x00000192C8C40000-0x00000192C8CF3000-memory.dmp
memory/3644-735-0x0000021BB7FF0000-0x0000021BB804D000-memory.dmp
memory/3828-573-0x0000021CC8CA0000-0x0000021CC8CB2000-memory.dmp
memory/3828-572-0x0000021CB05A0000-0x0000021CB05AC000-memory.dmp
memory/3828-571-0x0000021CB0520000-0x0000021CB057D000-memory.dmp
memory/3916-840-0x000001F8EB020000-0x000001F8EB196000-memory.dmp
memory/3916-841-0x000001F8EB3B0000-0x000001F8EB5BA000-memory.dmp
memory/4600-2885-0x0000000006720000-0x000000000672E000-memory.dmp
memory/4600-2883-0x00000000066D0000-0x00000000066D8000-memory.dmp
memory/4600-3336-0x0000000008170000-0x0000000008202000-memory.dmp
memory/4600-2884-0x0000000006750000-0x0000000006788000-memory.dmp
memory/4600-2704-0x00000000009A0000-0x0000000000B2A000-memory.dmp
memory/4768-448-0x0000000002C20000-0x0000000002DCC000-memory.dmp
memory/4768-447-0x0000000000420000-0x0000000002713000-memory.dmp
memory/4768-470-0x0000000002C20000-0x0000000002DCC000-memory.dmp
memory/4768-408-0x0000000000424000-0x0000000001F8C000-memory.dmp
memory/4768-469-0x0000000000420000-0x0000000002713000-memory.dmp
memory/4768-406-0x0000000000420000-0x0000000002713000-memory.dmp
memory/4768-581-0x0000000000420000-0x0000000002713000-memory.dmp
memory/4768-27-0x0000000000420000-0x0000000002713000-memory.dmp
memory/4768-3-0x00000000047C0000-0x0000000004849000-memory.dmp
memory/4768-407-0x0000000002C20000-0x0000000002DCC000-memory.dmp
memory/4768-2-0x0000000000424000-0x0000000001F8C000-memory.dmp
memory/4768-0-0x0000000000420000-0x0000000002713000-memory.dmp
memory/5412-732-0x0000014FBF5A0000-0x0000014FBF5FD000-memory.dmp
memory/5652-530-0x000002C1EEDE0000-0x000002C1EEDEC000-memory.dmp
memory/5976-559-0x0000025D656F0000-0x0000025D656FC000-memory.dmp
memory/5976-560-0x0000025D7D9A0000-0x0000025D7D9B2000-memory.dmp
memory/5976-558-0x0000025D65690000-0x0000025D656ED000-memory.dmp