asyncrat | 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamcmd.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamcmd.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
8276	timeout.exe
6724	timeout.exe
8968	timeout.exe
9504	timeout.exe

Detects videocard installed 1 TTPs 1 IoCs

Uses WMIC.exe to determine videocard installed.

System Information Discovery

pid	Process
8628	wmic.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 3 IoCs

defense_evasion

pid	Process
9104	taskkill.exe
9480	taskkill.exe
5200	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{5AD3E6FF-39DA-4974-A18C-6670BE0316B9}	ShellHost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
6152	schtasks.exe
6620	schtasks.exe
7128	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1764	Pulsar-Client.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5232	MEMZ.exe
5232	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
5020	MEMZ.exe
5020	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
5020	MEMZ.exe
5020	MEMZ.exe
4032	MEMZ.exe
4032	MEMZ.exe
5020	MEMZ.exe
5020	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
4032	MEMZ.exe
4032	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
5020	MEMZ.exe
5020	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
4032	MEMZ.exe
4032	MEMZ.exe
5020	MEMZ.exe
5020	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
4464	MEMZ.exe
5020	MEMZ.exe
5020	MEMZ.exe
4032	MEMZ.exe
4032	MEMZ.exe
3712	MEMZ.exe
3712	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe
5232	MEMZ.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	4700	4363463463464363463463463.exe
Token: SeDebugPrivilege	2120	kononiaZClient.exe
Token: SeDebugPrivilege	1764	Pulsar-Client.exe
Token: SeDebugPrivilege	4212	Phantom.exe
Token: SeShutdownPrivilege	2944	ShellHost.exe
Token: SeCreatePagefilePrivilege	2944	ShellHost.exe
Token: SeShutdownPrivilege	2944	ShellHost.exe
Token: SeCreatePagefilePrivilege	2944	ShellHost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2944	ShellHost.exe
4884	msedge.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2944	ShellHost.exe
2708	ClassTicket.exe
1880	ShellHost.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 2188	4700	4363463463464363463463463.exe	90
PID 4700 wrote to memory of 2120	4700	4363463463464363463463463.exe	92
PID 2188 wrote to memory of 5880	2188	IcarusLite-v1.1.13-win.exe	93
PID 5880 wrote to memory of 860	5880	IcarusLite-v1.1.13-win.exe	94
PID 4700 wrote to memory of 1764	4700	4363463463464363463463463.exe	95
PID 4700 wrote to memory of 2824	4700	4363463463464363463463463.exe	97
PID 4700 wrote to memory of 6008	4700	4363463463464363463463463.exe	99
PID 4700 wrote to memory of 3216	4700	4363463463464363463463463.exe	100
PID 4700 wrote to memory of 4212	4700	4363463463464363463463463.exe	102
PID 4700 wrote to memory of 3492	4700	4363463463464363463463463.exe	103
PID 4700 wrote to memory of 3152	4700	4363463463464363463463463.exe	105
PID 3152 wrote to memory of 2932	3152	injectorOld.exe	107
PID 6008 wrote to memory of 5232	6008	MEMZ.exe	108
PID 6008 wrote to memory of 3712	6008	MEMZ.exe	109
PID 6008 wrote to memory of 4464	6008	MEMZ.exe	110
PID 6008 wrote to memory of 5020	6008	MEMZ.exe	111
PID 6008 wrote to memory of 4032	6008	MEMZ.exe	112
PID 6008 wrote to memory of 3652	6008	MEMZ.exe	113
PID 3652 wrote to memory of 4148	3652	MEMZ.exe	114
PID 3492 wrote to memory of 4540	3492	steamcmd.exe	116
PID 4700 wrote to memory of 1264	4700	4363463463464363463463463.exe	122
PID 4700 wrote to memory of 2708	4700	4363463463464363463463463.exe	133
PID 3652 wrote to memory of 4884	3652	MEMZ.exe	134
PID 4884 wrote to memory of 6136	4884	msedge.exe	135
PID 4884 wrote to memory of 2144	4884	msedge.exe	137
PID 4884 wrote to memory of 1564	4884	msedge.exe	138
PID 4884 wrote to memory of 2144	4884	msedge.exe	137
PID 4884 wrote to memory of 2144	4884	msedge.exe	137
PID 4884 wrote to memory of 5040	4884	msedge.exe	139
PID 4884 wrote to memory of 5040	4884	msedge.exe	139
PID 4884 wrote to memory of 4196	4884	msedge.exe	141
PID 4884 wrote to memory of 4196	4884	msedge.exe	141
PID 4884 wrote to memory of 4196	4884	msedge.exe	141
PID 4884 wrote to memory of 5048	4884	msedge.exe	142
PID 4884 wrote to memory of 5048	4884	msedge.exe	142
PID 4884 wrote to memory of 5048	4884	msedge.exe	142
PID 4884 wrote to memory of 5852	4884	msedge.exe	143
PID 4884 wrote to memory of 2368	4884	msedge.exe	144
PID 4884 wrote to memory of 5852	4884	msedge.exe	143
PID 4884 wrote to memory of 5852	4884	msedge.exe	143
PID 4884 wrote to memory of 2368	4884	msedge.exe	144
PID 4884 wrote to memory of 2368	4884	msedge.exe	144
PID 4700 wrote to memory of 2544	4700	4363463463464363463463463.exe	145
PID 4540 wrote to memory of 760	4540	steamcmd.exe	146
PID 4884 wrote to memory of 484	4884	msedge.exe	177
PID 4884 wrote to memory of 484	4884	msedge.exe	177
PID 4884 wrote to memory of 6040	4884	msedge.exe	149
PID 4884 wrote to memory of 6040	4884	msedge.exe	149
PID 4884 wrote to memory of 6040	4884	msedge.exe	149
PID 4884 wrote to memory of 6212	4884	msedge.exe	150
PID 4884 wrote to memory of 6212	4884	msedge.exe	150
PID 4884 wrote to memory of 6212	4884	msedge.exe	150
PID 4884 wrote to memory of 6232	4884	msedge.exe	151
PID 4884 wrote to memory of 6240	4884	msedge.exe	152
PID 4884 wrote to memory of 6232	4884	msedge.exe	151
PID 4884 wrote to memory of 6240	4884	msedge.exe	152
PID 4700 wrote to memory of 6656	4700	4363463463464363463463463.exe	153
PID 4884 wrote to memory of 6912	4884	msedge.exe	204
PID 4700 wrote to memory of 6988	4700	4363463463464363463463463.exe	156

C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
"C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
1⤵
- Downloads MZ/PE file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\IcarusLite-v1.1.13-win.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5880
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c title Icarus Lite
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:860
- C:\Users\Admin\AppData\Local\Temp\Files\kononiaZClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\kononiaZClient.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:2120
- C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Pulsar-Client.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:1764
- C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\fscan32.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824
- C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5232
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4464
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5020
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\MEMZ.exe" /main
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3652
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4148
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=john+cena+midi+legit+not+converted
      4⤵
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:4884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x368,0x7ff85f09c188,0x7ff85f09c194,0x7ff85f09c1a0
        5⤵
        
        PID:6136
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,15135594940249250241,11145024109523507956,262144 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:2
        5⤵
        
        PID:2144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,14763463433253394750,16231052677779517151,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:11
        5⤵
        System Time Discovery
        
        PID:1564
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2204,i,73862258721759503,17530416429707733461,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:13
        5⤵
        
        PID:5040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3620,i,18344237750325183881,2344957813977187099,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
        5⤵
        
        PID:4196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,3354711528822853844,17250269560189138808,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
        5⤵
        
        PID:5048
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11977585525262606738,8127642485006860837,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
        5⤵
        
        PID:5852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,15633094979311927875,8111456544050720435,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:9
        5⤵
        
        PID:2368
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,38118393357853329,7774346770313744344,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:14
        5⤵
        
        PID:484
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5368,i,11860172549788482163,14392854884949223593,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:1
        5⤵
        
        PID:6040
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3544,i,13170262810671074713,15892107239082114760,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:1
        5⤵
        
        PID:6212
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,5106582611136329732,17057836387915967153,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
        5⤵
        
        PID:6232
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,16847295949991280920,4875593946940033963,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:14
        5⤵
        
        PID:6240
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,2532574917377802340,9291943652215562251,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:6884
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,2532574917377802340,9291943652215562251,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:14
        5⤵
        
        PID:6912
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,14999603823218430964,10875860613010741226,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
        5⤵
        
        PID:5528
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,18317296657008245192,11740691219198993871,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
        5⤵
        
        PID:200
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,10089558329798450306,7828339000839552035,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
        5⤵
        
        PID:6708
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,4924430601378367057,13173722910062763793,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:14
        5⤵
        
        PID:6612
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4636,i,12554080575406402578,11027461228289969933,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:14
        5⤵
        
        PID:2468
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4640,i,2405424349098668622,5126266521448256654,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:14
        5⤵
        
        PID:5796
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,2460597549116820289,1569070097638704869,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
        5⤵
        
        PID:1568
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5900,i,8578389501732863909,1792383823769512974,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
        5⤵
        
        PID:7808
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4592,i,542728095108945466,3076124560257347210,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:1
        5⤵
        
        PID:7904
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,11869817723171547587,5571421935877604345,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
        5⤵
        
        PID:6852
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3596,i,11421242643881387467,7207207121851598638,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:1
        5⤵
        
        PID:6216
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4600,i,13253387687482042539,4549244924316746780,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
        5⤵
        
        PID:9032
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6924,i,7235864173342283967,7945199072277714652,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:1
        5⤵
        
        PID:8344
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6684,i,10826520002720031944,15951524393462690923,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
        5⤵
        
        PID:8396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6732,i,14783468055929408209,12762715108196928774,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
        5⤵
        
        PID:7320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5956,i,6814215654440833305,9064189091127092491,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
        5⤵
        
        PID:9348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4512,i,12843007608730154214,5544964374992639432,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
        5⤵
        
        PID:9060
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5748,i,12953053232505082449,2517948030969316615,262144 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:10
        5⤵
        
        PID:7556
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5568,i,6472972704119653426,16549172913913669474,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
        5⤵
        
        PID:9104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7272,i,6576821533620374082,2427972472712715223,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
        5⤵
        
        PID:9100
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6920,i,8996200249057966444,16605059660970316794,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
        5⤵
        
        PID:9256
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=6888,i,9621020005019405213,3856133391113908937,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:1
        5⤵
        
        PID:2816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3760,i,9577621570300376977,7224770218437752776,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:1
        5⤵
        
        PID:8804
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6496,i,12969945340048450346,8042399647718971051,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:1
        5⤵
        
        PID:5692
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=2124,i,4092891720125658478,17662154867653242583,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        5⤵
        
        PID:8276
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7240,i,4492273886096828423,16214909564845514452,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
        5⤵
        
        PID:7144
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=6644,i,8622785208674429730,11286813227747224705,2097152 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:1
        5⤵
        
        PID:7432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,7957241529025560317,38322532514693919,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        5⤵
        
        PID:7800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,9154731784216741230,7037552817251960317,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
        5⤵
        
        PID:8672
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7260,i,17732793802648039905,12236950843006834288,524288 --field-trial-handle=2868,i,90418297508857946,18144677820661316932,262144 --variations-seed-version --mojo-platform-channel-handle=7668 /prefetch:14
        5⤵
        
        PID:6400
  - - C:\Windows\SysWOW64\Taskmgr.exe
      "C:\Windows\System32\Taskmgr.exe"
      4⤵
      PID:7136
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+get+money
      4⤵
      PID:7700
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
      4⤵
      PID:8284
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:7624
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
      4⤵
      PID:1132
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=minecraft+hax+download+no+virus
      4⤵
      PID:7912
- C:\Users\Admin\AppData\Local\Temp\Files\donut.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\donut.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3216
- C:\Users\Admin\AppData\Local\Temp\Files\Phantom.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Phantom.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe
      C:\Users\Admin\AppData\Local\Temp\Files\steamcmd.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:760
- C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\injectorOld.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    - Executes a command shell one-liner
    PID:2932
- C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Anap.a.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1264
- C:\Users\Admin\AppData\Local\Temp\Files\ClassTicket.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\ClassTicket.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2708
- C:\Users\Admin\AppData\Local\Temp\Files\1003b.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1003b.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Users\Admin\AppData\Local\Temp\Files\offlinepackv4.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\offlinepackv4.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6656
- C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\BruterV3.1.exe"
  2⤵
  - Executes dropped EXE
  PID:6988
- - C:\Windows\SYSTEM32\schtasks.exe
    "schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6620
- - C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe
    "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe"
    3⤵
    PID:6776
  - - C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows_Host_Process" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe" /rl HIGHEST /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:7128
- C:\Users\Admin\AppData\Local\Temp\Files\Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Update.exe"
  2⤵
  PID:6572
- C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\yx_dts.exe"
  2⤵
  PID:6736
- - C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
    "C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" SW_SHOWNORMAL
    3⤵
    PID:7084
- - C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
    "C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /autorun /setuprun
    3⤵
    PID:6544
- - C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe
    "C:\Users\Admin\AppData\Roaming\dts\mydts\dts.exe" /setupsucc
    3⤵
    PID:5116
- C:\Users\Admin\AppData\Local\Temp\Files\file_3dfa6b71eb1f52a6.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file_3dfa6b71eb1f52a6.exe"
  2⤵
  PID:5960
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"' & exit
    3⤵
    - Executes a command shell one-liner
    PID:7116
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc onlogon /rl highest /tn "vortex" /tr '"C:\Users\Admin\AppData\Roaming\vortex.exe"'
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6152
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF6E4.tmp.bat""
    3⤵
    - Executes a command shell one-liner
    PID:2792
  - - C:\Windows\system32\timeout.exe
      timeout 3
      4⤵
      Delays execution with timeout.exe
      PID:6724
  - - C:\Users\Admin\AppData\Roaming\vortex.exe
      "C:\Users\Admin\AppData\Roaming\vortex.exe"
      4⤵
      PID:3420
- C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\XClient.exe"
  2⤵
  PID:6420
- C:\Users\Admin\AppData\Local\Temp\Files\GARO%20X.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\GARO%20X.exe"
  2⤵
  PID:6768
- C:\Users\Admin\AppData\Local\Temp\Files\center.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\center.exe"
  2⤵
  PID:6740
- - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
    C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CenterRun.exe
    3⤵
    PID:6916
  - - C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe
      "C:\Users\Admin\Documents\seetrol\center\SeetrolCenter.exe"
      4⤵
      PID:5964
- C:\Users\Admin\AppData\Local\Temp\Files\client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\client.exe"
  2⤵
  PID:6220
- C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\support.client.exe"
  2⤵
  PID:6948
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
    3⤵
    PID:4196
- C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\keygen.exe"
  2⤵
  PID:4984
- C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"
  2⤵
  PID:6912
- - C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\Isass.exe"
    3⤵
    PID:7396
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "ver"
      4⤵
      Executes a command shell one-liner
      PID:7700
- C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\qcoin139.exe"
  2⤵
  PID:7528
- C:\Users\Admin\AppData\Local\Temp\Files\20030721.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\20030721.exe"
  2⤵
  PID:7920
- C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\CFXBypass.exe"
  2⤵
  PID:8012
- C:\Users\Admin\AppData\Local\Temp\Files\down.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\down.exe"
  2⤵
  PID:7176
- C:\Users\Admin\AppData\Local\Temp\Files\16.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\16.exe"
  2⤵
  PID:6528
- C:\Users\Admin\AppData\Local\Temp\Files\2.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\2.exe"
  2⤵
  PID:7604
- - C:\Users\Admin\AppData\Local\Temp\{542F8547-29AB-459D-BEF2-25BD2FB6D26D}\2.exe
    C:\Users\Admin\AppData\Local\Temp\{542F8547-29AB-459D-BEF2-25BD2FB6D26D}\2.exe -package:"C:\Users\Admin\AppData\Local\Temp\Files\2.exe" -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\AppData\Local\Temp\{542F8547-29AB-459D-BEF2-25BD2FB6D26D}\Disk1\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{542F8547-29AB-459D-BEF2-25BD2FB6D26D}\" -IS_OriginalLauncher:"C:\Users\Admin\AppData\Local\Temp\{542F8547-29AB-459D-BEF2-25BD2FB6D26D}\Disk1\2.exe"
    3⤵
    PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B26333ED-3B3C-493B-B84D-89FFCEACBCC5}
      4⤵
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3382E528-2A30-4DDE-8C12-96FEC96376EE}
      4⤵
      PID:2400
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{100AC934-ED5B-4C08-8B53-8D92BC769154}
      4⤵
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{75E1174E-250B-4B05-9FC5-401F410CB482}
      4⤵
      PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9836F297-A323-4C38-B9ED-3EBDC8A4D80E}
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{075F9141-C8ED-4D6B-BF3B-C326A185C627}
      4⤵
      PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\{4E2E774F-592C-4198-B7CA-0B66420A56DC}\DigitalUnit.exe
      C:\Users\Admin\AppData\Local\Temp\{E12978FB-0891-496B-A88D-9B95ECB4AE73}\{4E2E774F-592C-4198-B7CA-0B66420A56DC}\DigitalUnit.exe
      4⤵
      PID:7816
- C:\Users\Admin\AppData\Local\Temp\Files\news2_02.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\news2_02.exe"
  2⤵
  PID:8168
- C:\Users\Admin\AppData\Local\Temp\Files\QQHelper_1540.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\QQHelper_1540.exe"
  2⤵
  PID:2000
- C:\Users\Admin\AppData\Local\Temp\Files\1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
  2⤵
  PID:8612
- - C:\Users\Admin\AppData\Local\Temp\is-VUIS5.tmp\1.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VUIS5.tmp\1.tmp" /SL5="$4024E,17478519,807424,C:\Users\Admin\AppData\Local\Temp\Files\1.exe"
    3⤵
    PID:8676
  - - C:\Users\Admin\AppData\Local\archive\r8gQdW6\2a0WWGh.exe
      "C:\Users\Admin\AppData\Local\archive\r8gQdW6\2a0WWGh"
      4⤵
      PID:9016
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\archive\r8gQdW6\'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:9004
- C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
  2⤵
  PID:8776
- C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\4J8576A0E8V3.exe"
  2⤵
  PID:9008
- - C:\Windows\System32\conhost.exe
    "C:\Windows\System32\conhost.exe"
    3⤵
    PID:8496
- C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\G7_Update.exe"
  2⤵
  PID:8292
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\GMT\UpdateDIr\G7_Update_260406\install.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:6796
  - - C:\Windows\SysWOW64\taskkill.exe
      Taskkill /f /im "BasmDocu.exe"
      4⤵
      Kills process with taskkill
      PID:9104
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:8968
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /t 1
      4⤵
      Delays execution with timeout.exe
      PID:9504
- C:\Users\Admin\AppData\Local\Temp\Files\NanoCore_Portable.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\NanoCore_Portable.exe"
  2⤵
  PID:8720
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\TempDel.bat" "
    3⤵
    - Executes a command shell one-liner
    PID:8984
  - - C:\Windows\SysWOW64\mode.com
      mode 30,20
      4⤵
      PID:9160
  - - C:\Windows\SysWOW64\timeout.exe
      timeout /nobreak 10
      4⤵
      Delays execution with timeout.exe
      PID:8276
  - - C:\Users\Admin\AppData\Local\Temp\NanoCore.exe
      "C:\Users\Admin\AppData\Local\Temp\NanoCore.exe"
      4⤵
      PID:8924
- C:\Users\Admin\AppData\Local\Temp\Files\byk4d5tg4nyo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\byk4d5tg4nyo.exe"
  2⤵
  PID:9120
- C:\Users\Admin\AppData\Local\Temp\Files\news_01.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\news_01.exe"
  2⤵
  PID:9228
- C:\Users\Admin\AppData\Local\Temp\Files\12.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\12.exe"
  2⤵
  PID:9636
- C:\Users\Admin\AppData\Local\Temp\Files\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Installer_%E6%99%BA%E8%83%BD%E7%BF%BB%E8%AF%91%E5%AE%98_r1.7.9.exe"
  2⤵
  PID:10224
- C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\brbotnet.exe"
  2⤵
  PID:8680
- C:\Users\Admin\AppData\Local\Temp\Files\000.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\000.exe"
  2⤵
  PID:7708
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - Executes a command shell one-liner
    PID:4860
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:9480
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:5200
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:9544
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:9384
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 3288
    3⤵
    - Program crash
    PID:8176
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 7708 -s 3288
    3⤵
    - Program crash
    PID:9668
- C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\jd127.exe"
  2⤵
  PID:9428
- C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"
  2⤵
  PID:436
- - C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe
    "C:\Users\Admin\AppData\Local\Temp\Files\stealinfo.exe"
    3⤵
    PID:6388
- C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\SharpHound.exe"
  2⤵
  PID:8388
- C:\Users\Admin\AppData\Local\Temp\Files\file_c0d2eb6a8b73120b.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\file_c0d2eb6a8b73120b.exe"
  2⤵
  PID:6304
- C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"
  2⤵
  PID:7816
- C:\Users\Admin\AppData\Local\Temp\Files\svc.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\svc.exe"
  2⤵
  PID:9444
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" create WinUpdateHelper binPath= "\"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe\"" start= auto DisplayName= "Windows Update Helper Service"
    3⤵
    - Launches sc.exe
    PID:9756
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" description WinUpdateHelper "Manages Windows Update helper components"
    3⤵
    - Launches sc.exe
    PID:9244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\UpdateService' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4756
- - C:\Windows\SYSTEM32\sc.exe
    "sc.exe" start WinUpdateHelper
    3⤵
    - Launches sc.exe
    PID:9996
- C:\Users\Admin\AppData\Local\Temp\Files\4.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\4.exe"
  2⤵
  PID:8576
- - C:\Users\Admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe
    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\DriverSetup.exe"
    3⤵
    PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\RarSFX0\devsetup64.exe
      /install /debug
      4⤵
      PID:9084
- C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\Brontok.exe"
  2⤵
  PID:2932
- C:\Users\Admin\AppData\Local\Temp\Files\v.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\v.exe"
  2⤵
  PID:9716
- C:\Users\Admin\AppData\Local\Temp\Files\nmix.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\nmix.exe"
  2⤵
  PID:3252
- C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe
  "C:\Users\Admin\AppData\Local\Temp\Files\alphaTweaks.exe"
  2⤵
  PID:9036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1612

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D0
1⤵
PID:3376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:124

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2944

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6432

C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe
C:\Users\Admin\AppData\Roaming\RealtekAudio\Bruter.exe
1⤵
PID:6996

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:484

C:\Users\Admin\AppData\Roaming\vortex.exe
"C:\Users\Admin\AppData\Roaming\vortex.exe"
1⤵
PID:7132

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:4716

C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe
"C:\Program Files\WindowsApps\Microsoft.SecHealthUI_1000.26100.1.0_x64__8wekyb3d8bbwe\SecHealthUI.exe" -ServerName:SecHealthUI.AppX8tam42xc7v2czs3s1nt0nkxvfjtepzp9.mca
1⤵
PID:8088

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding
1⤵
PID:7016

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WbioSvcGroup -s WbioSrvc
1⤵
PID:7804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:7844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:9520
- C:\Windows\system32\schtasks.exe
  schtasks.exe /delete /tn "zgtQJ-QCQkAbtd0FRDjN" /f
  2⤵
  PID:10124

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:7416

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {3522D7AF-4617-4237-AAD8-5860231FC9BA} -Embedding
1⤵
PID:9260

C:\Windows\System32\PickerHost.Exe
C:\Windows\System32\PickerHost.Exe FirewallNotificationDialogServer -Embedding
1⤵
PID:9472

C:\Windows\system32\cmd.exe
"cmd /c cd /d "C:\Users\Admin\AppData\Local\archive\r8gQdW6\" && start "" "C:\Users\Admin\AppData\Local\archive\r8gQdW6\2a0WWGh.exe""
1⤵
PID:1712
- C:\Users\Admin\AppData\Local\archive\r8gQdW6\2a0WWGh.exe
  "C:\Users\Admin\AppData\Local\archive\r8gQdW6\2a0WWGh.exe""
  2⤵
  PID:9000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 7708 -ip 7708
1⤵
PID:8712

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:1052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 616 -p 7708 -ip 7708
1⤵
PID:1088

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
PID:8488

C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe
"C:\ProgramData\Microsoft\Windows Update Helper\msvc.exe"
1⤵
PID:4780
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get TotalVisibleMemorySize /value
  2⤵
  PID:3372
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" os get FreePhysicalMemory /value
  2⤵
  PID:9180
- C:\Windows\System32\Wbem\wmic.exe
  "wmic" path win32_VideoController get Name,AdapterRAM,DriverVersion /value
  2⤵
  - Detects videocard installed
  PID:8628

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{16660fe0-22d5-1b4b-9f51-6063b7657162}\hw_usbdev.inf" "9" "40aa5d6b7" "0000000000000178" "WinSta0\Default" "00000000000000F0" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:6524

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{f57dd53f-39f6-7049-97e8-31e5b88ca84d}\diagswitchdrv.inf" "9" "4e8d9997f" "00000000000000F0" "WinSta0\Default" "0000000000000180" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:8480

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0615c1c1-4a67-4845-a03e-e01c2518b74c}\hw_ctrlfakedev.inf" "9" "4a8921833" "0000000000000180" "WinSta0\Default" "0000000000000198" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:8532

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8d7dbb29-4c75-0143-8243-3250322132e3}\hw_quser.inf" "9" "4a2ee005b" "00000000000001A4" "WinSta0\Default" "000000000000019C" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:9736

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{0ab9c41b-a758-fe40-a610-32748dd20178}\qu_usb_serial.inf" "9" "41cf79f4b" "00000000000001A8" "WinSta0\Default" "00000000000001A0" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:1056

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{038bcb05-5aab-7e40-9662-d2d9f28e2c91}\hw_goadb.inf" "9" "4de96bd3f" "00000000000001A0" "WinSta0\Default" "0000000000000194" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:2984

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{55ca3fc3-1901-f04c-b2c1-0b67d5a5c2bf}\hw_gohdb.inf" "9" "43b3eccaf" "00000000000001B4" "WinSta0\Default" "00000000000001B8" "208" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Driver\X64"
1⤵
PID:6856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery