Analysis
- user interaction
yes - max time kernel
1798s - max time network
1796s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
03/09/2026, 14:06
General
- Target fabric-installer-1.1.2.exe
- Size 479KB
- Sample260903-regnlaydng
- SHA256 2fa3c8644aea9b469e722d3218437c00a462646422791eff6e6252d87c8dd1da
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 4 IoCs
- Drops file in Drivers directory 3 IoCs
- Checks computer location settings 2 TTPs 22 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 64 IoCs
- Loads dropped DLL 64 IoCs
- Modifies system executable filetype association 2 TTPs 4 IoCs
- Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Adds Run key to start application 2 TTPs 4 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Contacts third-party web service commonly abused for C2 1 TTPs 21 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 16 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 7 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Inno Setup is an open-source installation builder for Windows applications. 4 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 21 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- Modifies registry key 1 TTPs 25 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 43 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 32 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fabric-installer-1.1.2.exe"C:\Users\Admin\AppData\Local\Temp\fabric-installer-1.1.2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-version"2⤵
-
-
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe"javaw.exe" "-jar" "C:\Users\Admin\AppData\Local\Temp\fabric-installer-1.1.2.exe" "-fabricInstallerBootstrap" "true"2⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa36d4c728,0x7ffa36d4c734,0x7ffa36d4c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2144,i,11048223523806320274,17279162480062330318,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2160 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1724,i,10733726127052235665,11923989763454496346,262144 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2044 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2412,i,10075813692001926709,7042408525968822598,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2432 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3220,i,13508258031127841420,2174700882085469621,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3236 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3260,i,17703730016147489166,12346107509056230020,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,7181661746976842798,10187777740688048809,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4480 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4740,i,1138809571986876479,4278104040018594414,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,15843604162469099707,14882956232469360220,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5852,i,611894477197968617,12767688381169299044,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3648,i,2756370317259110757,16592755444021195235,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3596 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5824,i,6528369362377831777,3134977699098943073,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,17738653084580119463,6372036950144728634,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5564 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,8573489902290743725,8299970686071278799,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5568 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5572,i,11007450841171323673,16108020872350368447,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3692 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5824,i,5871218792453257039,12705502876375266882,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6032 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6152,i,1492871268770410289,14476028293640752769,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6164 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6404,i,17215198448202978478,18085743893223226204,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6412 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,17128309517630472033,18235730465338724666,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6368 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,1943990673560634102,2919524434289673543,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6564 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=3192,i,17753813258549050412,6901941856553518522,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6132 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7068,i,8973572150750962808,2148434098493501277,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2776 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7012,i,7336811686641171601,11635765700314967363,2097152 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7036 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6952,i,14058939223824145522,8602354094276200651,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5760 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7316,i,15668374880107978356,2903533101865476426,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7292 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=7256,i,13787623647601608357,13695365126055001364,262144 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7428,i,16138233911642467170,314809675998795642,524288 --field-trial-handle=2100,i,5919587549052717090,4179071318199388551,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=7424 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Discord-Fake-Game-Launcher-Setup-0.3.3.exe"C:\Users\Admin\Downloads\Discord-Fake-Game-Launcher-Setup-0.3.3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe"C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe"C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord-fake-game-launcher-ui" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1644,i,13609074778152881355,11348177135753746450,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1636 /prefetch:22⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe"C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord-fake-game-launcher-ui" --field-trial-handle=2228,i,13609074778152881355,11348177135753746450,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:32⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe"C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord-fake-game-launcher-ui" --app-path="C:\Program Files\Discord Fake Game Launcher\resources\app.asar" --enable-sandbox --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2484,i,13609074778152881355,11348177135753746450,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Roaming\discord-fake-game-launcher-ui\games\1067552066454695965\marvel snap\snap.exe"C:\Users\Admin\AppData\Roaming\discord-fake-game-launcher-ui\games\1067552066454695965\marvel snap\snap.exe" "MARVEL SNAP"2⤵
- Executes dropped EXE
-
-
C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe"C:\Program Files\Discord Fake Game Launcher\Discord Fake Game Launcher.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord-fake-game-launcher-ui" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3844,i,13609074778152881355,11348177135753746450,262144 --enable-features=kWebSQLAccess --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:82⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\dashost.exedashost.exe {6e869ac9-931b-4219-a1c06a4f545d9bc2}2⤵
-
-
C:\Users\Admin\Downloads\DiscordSetup (1).exe"C:\Users\Admin\Downloads\DiscordSetup (1).exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --squirrel-install 1.0.92553⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9255 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x51c,0x520,0x524,0x518,0x528,0x7ff7a6e909d8,0x7ff7a6e909e8,0x7ff7a6e909f84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exeC:\Users\Admin\AppData\Local\Discord\Update.exe --createShortcut Discord.exe --setupIcon C:\Users\Admin\AppData\Local\Discord\app.ico4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,4633786482382580793,10744902895477720664,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1832,i,7517114459253552198,5736485468146116795,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1824 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1828,i,4633786482382580793,10744902895477720664,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1832,i,7517114459253552198,5736485468146116795,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2060 /prefetch:34⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f4⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f4⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f4⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe\",-1" /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe\" --url -- \"%1\"" /f4⤵
- Modifies registry class
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --squirrel-firstrun3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9255 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x518,0x51c,0x520,0x514,0x524,0x7ff7a6e909d8,0x7ff7a6e909e8,0x7ff7a6e909f84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1864,i,7030653706902894432,9058597798210728857,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1868,i,5500593638455770768,13725414822018706213,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1908 /prefetch:34⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,7030653706902894432,9058597798210728857,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1868,i,5500593638455770768,13725414822018706213,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1860 /prefetch:24⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f4⤵
- Modifies registry key
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1788443905838295 --launch-time-ticks=767725630 --field-trial-handle=1864,i,7030653706902894432,9058597798210728857,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1868,i,5500593638455770768,13725414822018706213,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2868 --splash-media-format=webm /prefetch:14⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe\",-1" /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe\" --url -- \"%1\"" /f4⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f4⤵
- Adds Run key to start application
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9256 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.9.0 --initial-client-data=0x538,0x53c,0x540,0x534,0x544,0x7ff74c2e6998,0x7ff74c2e69a8,0x7ff74c2e69b85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1908 /prefetch:25⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2072 /prefetch:35⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /ve /d "URL:Discord Protocol" /f5⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2876 --splash-media-format=webm /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord /v "URL Protocol" /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\DefaultIcon /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe\",-1" /f5⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Classes\Discord\shell\open\command /ve /d "\"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe\" --url -- \"%1\"" /f5⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3968 --enable-node-leakage-in-renderers /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3996 --enable-node-leakage-in-renderers /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation6⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4876 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4896 /prefetch:85⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discordapp.com/handoff?rpc=6463&key=47209b65-0381-4034-9fbc-72a48e070be25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument https://discordapp.com/handoff?rpc=6463&key=47209b65-0381-4034-9fbc-72a48e070be26⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x248,0x7ffa281dc188,0x7ffa281dc194,0x7ffa281dc1a07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4047363085434315446,16103407369525222762,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:37⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,15201800293492551030,372386009008958475,262144 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,11965861267629562324,18384186152043404071,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,2900317898124961329,18113213590080690972,2097152 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3508,i,11858061846320782108,6812170240010116208,2097152 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,15123147945273780597,11944260451430693261,2097152 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,7976601238986924123,3066326511255090995,2097152 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,11790743858712172472,14803901178302781474,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,5067167983482398057,1353883362714887166,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5268,i,7614583906301014156,14968203420085235668,2097152 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,16330160245906815087,2497917559561024633,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,15447130539699234898,14137032300878642590,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14927398165438991503,5595192930902176400,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,14927398165438991503,5595192930902176400,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,8377647388246181884,18294045287271998048,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,8847402608624567257,13869580745175327731,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7717700575546617629,14946277753400948406,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,7926303859545732332,7466753958801429761,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4976665933480783558,15529165177599009499,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,8737934685562840911,3142379227252753140,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:87⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,9220023253516772482,1692295348116830894,524288 --field-trial-handle=2144,i,11168155275602713195,17745435963289680612,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:87⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADoAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAEIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=840 /prefetch:85⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=1576 --enable-node-leakage-in-renderers /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --enable-sandbox --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=1912,i,13119747316947259269,11675900790684083610,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1916,i,12704047530933109882,11521373119607169236,4 --trace-process-track-uuid=3190708997556373682 --mojo-platform-channel-handle=3104 --enable-node-leakage-in-renderers /prefetch:15⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe query HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f5⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /d "\"C:\Users\Admin\AppData\Local\Discord\Update.exe\" --processStart Discord.exe --process-start-args \"--start-inactive\"" /f5⤵
- Adds Run key to start application
- Modifies registry key
-
-
-
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exe"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe --process-start-args "--start-inactive"1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --start-inactive2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9255 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.7.1 --initial-client-data=0x4fc,0x500,0x504,0x4f8,0x508,0x7ff7a6e909d8,0x7ff7a6e909e8,0x7ff7a6e909f83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=952,i,4136250983551510311,12166793788237034406,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=2004,i,5847890076411236257,16592464234009549897,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2028 /prefetch:33⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9255\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=952,i,4136250983551510311,12166793788237034406,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=2004,i,5847890076411236257,16592464234009549897,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=948 /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa36d4c728,0x7ffa36d4c734,0x7ffa36d4c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1728,i,5708307595166602920,8559964218397638962,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2424 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1648,i,17634317574175665670,4634876058231129656,262144 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2384 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=2024,i,8708411736039255437,17615695996479334303,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2448 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,7137072040254796693,595501425864210436,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3180,i,18002357887440044159,8608916377350558501,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3212 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4532,i,5261513098092999773,14054362615743727096,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,925959757435892259,6088942644717617441,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5336 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,2481462806732719066,3145284028409176,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5440 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,7290143613766362285,1177524481714339200,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5632 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,8302069042522087617,17159008898520743809,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5604 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5768,i,6269198091219539469,14199127771381557897,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5800 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5820,i,14854517956886081309,935348491660223985,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5848 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3616,i,17218951736881510890,12455314973193310708,262144 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3240 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,4640831948351225368,5131727801670246313,524288 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=4440 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3252,i,9215461411251602354,5644711922629228299,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5752 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3680,i,3195454444229822350,4108568645952512845,2097152 --field-trial-handle=2388,i,3524909289964156807,8389819669743147280,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=4520 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x49c 0x3f41⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Discord\Update.exe"C:\Users\Admin\AppData\Local\Discord\Update.exe" --uninstall2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --squirrel-uninstall 1.0.92563⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9256 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.9.0 --initial-client-data=0x534,0x538,0x53c,0x464,0x540,0x7ff74c2e6998,0x7ff74c2e69a8,0x7ff74c2e69b84⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\Update.exeC:\Users\Admin\AppData\Local\Discord\Update.exe --removeShortcut Discord.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,10608751772798906780,15896456570237228818,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1836,i,4596253863802805060,18137715597805128173,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1828 /prefetch:24⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v Discord /f4⤵
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --secure-schemes=sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sentry-ipc --fetch-schemes=sentry-ipc --field-trial-handle=1832,i,10608751772798906780,15896456570237228818,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1836,i,4596253863802805060,18137715597805128173,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1416 /prefetch:34⤵
- Executes dropped EXE
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run /v Discord /f4⤵
- Modifies registry key
-
-
C:\Windows\System32\reg.exeC:\Windows\System32\reg.exe delete HKCU\Software\Classes\Discord /f4⤵
- Modifies registry class
- Modifies registry key
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_utils-1\discord_utils\DiscordSystemHelper.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_utils-1\discord_utils\DiscordSystemHelper.exe uninstall --wait4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa36d4c728,0x7ffa36d4c734,0x7ffa36d4c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1688,i,9296838132288307272,8160293157890042026,262144 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2040 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1952,i,9701442739926481407,5624804448130750906,524288 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2076 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,13133249574265865374,18112270689899222741,524288 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2568 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,5958978834439539985,8300593587183795063,2097152 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2660 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3236,i,14434336262346987332,10083432427752510938,2097152 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3268 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4540,i,5711901338811868917,5383736384969474262,2097152 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=4564 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5304,i,5815009462274169765,15331640795127882271,524288 --field-trial-handle=2044,i,17493972510313967602,6796414112183874869,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\AppData\Local\Discord\Update.exe"C:\Users\Admin\AppData\Local\Discord\Update.exe" --processStart Discord.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exeC:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\discord /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\discord\Crashpad --url=https://f.a.k/e --annotation=_productName=discord --annotation=_version=1.0.9256 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=42.9.0 --initial-client-data=0x51c,0x520,0x524,0x518,0x528,0x7ff74c2e6998,0x7ff74c2e69a8,0x7ff74c2e69b83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1884 /prefetch:23⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2032 /prefetch:33⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --no-sandbox --no-zygote --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2464 --splash-media-format=webp /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3736 --enable-node-leakage-in-renderers /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --app-user-model-id=com.squirrel.Discord.Discord --app-path="C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\resources\app.asar" --no-sandbox --no-zygote --enable-blink-features=EnumerateDevices,AudioOutputDevices --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --enable-h264-mf --enable-h264-mf-zero-copy --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3948 --enable-node-leakage-in-renderers /prefetch:13⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Checks processor information in registry
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" nvidia4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" amd4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" intel4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe"\\?\C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\modules\discord_voice-1\discord_voice\gpu_encoder_helper.exe" windows-media-foundation4⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4128 /prefetch:83⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe"C:\Users\Admin\AppData\Local\Discord\app-1.0.9256\Discord.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\discord" --standard-schemes=disclip --secure-schemes=disclip,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=disclip,sentry-ipc --fetch-schemes=disclip,sentry-ipc --streaming-schemes=disclip --field-trial-handle=1888,i,5517579166180287918,10247907484534582174,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports --disable-features=AllowAggressiveThrottlingWithWebSocket,DropInputEventsWhilePaintHolding,HardwareMediaKeyHandling,IntensiveWakeUpThrottling,LocalNetworkAccessChecks,MediaSessionService,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation,UseEcoQoSForBackgroundProcess,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --pseudonymization-salt-handle=1892,i,17095992809667642646,9516580978662438480,4 --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4084 /prefetch:83⤵
- Executes dropped EXE
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa36d4c728,0x7ffa36d4c734,0x7ffa36d4c7402⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1756,i,12210148992094192066,8434891765835861273,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2080 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1644,i,3670714454173099001,8324542212057587339,262144 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=1748 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,17692440964131973949,16715583082764223712,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=2536 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3188,i,4909903129480500825,8848539159539318935,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3240 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3192,i,9171118607728415464,4051381483276949077,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4528,i,16709447227288410712,18340011202282100097,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=4544 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,11514672761394854952,7777377718143024764,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5372 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5432,i,1170312731596636910,1720576978132734816,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5624 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3632,i,540547577943563831,15247635817642759356,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=3576 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4696,i,15013128297099489295,2188497732550917231,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=4552 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4436,i,17087039467714019677,2294457277594828161,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5740 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=6008,i,1441557591157499246,8828885464107270054,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5928 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6088,i,15509044916923362030,12829945350181271998,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=6092 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3680,i,8956845448591255387,16959308602278537805,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5792 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6352,i,994570177428740487,156886836953403413,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=6392 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3256,i,13794681248725020962,17724403034041580548,2097152 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=6356 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6584,i,2740858712352643887,4002534945211287414,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=5740 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6592,i,8772704471023647169,6029179955394109489,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=6376 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6596,i,12657217268372816833,3610680838555021749,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=6428 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,17487254861921036420,2818421510695942039,524288 --field-trial-handle=2052,i,11186436106803027876,4596188610717179579,262144 --variations-seed-version=20260903-010027.512000-production --mojo-platform-channel-handle=6428 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\RevoUninProSetup.exe"C:\Users\Admin\Downloads\RevoUninProSetup.exe"2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\is-1708B.tmp\RevoUninProSetup.tmp"C:\Users\Admin\AppData\Local\Temp\is-1708B.tmp\RevoUninProSetup.tmp" /SL5="$200236,17672142,196608,C:\Users\Admin\Downloads\RevoUninProSetup.exe"3⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im ruplp.exe4⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RUExt.dll"4⤵
- Modifies system executable filetype association
- Modifies registry class
-
-
C:\Windows\system32\rundll32.exe"rundll32.exe " SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\VS Revo Group\Revo Uninstaller Pro\revoflt.inf4⤵
- Drops file in Drivers directory
- Adds Run key to start application
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r5⤵
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o6⤵
-
-
-
-
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\ruplp.exe" /regserver /NOREDIRECT4⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe" /bc4⤵
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"C:\Program Files\VS Revo Group\Revo Uninstaller Pro\RevoUninPro.exe"4⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Discord\Update.exeC:\Users\Admin\AppData\Local\Discord\Update.exe --uninstall5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.revouninstaller.com/pro-install-thankyou/4⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c8,0x2cc,0x2d0,0x2c4,0x29c,0x7ffa281dc188,0x7ffa281dc194,0x7ffa281dc1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,11929851329079872244,2943077166837550537,524288 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:35⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,5474196741950435753,5832746246779494090,262144 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,8206762046842006537,8588004344122018547,524288 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17479959863486865181,13507203089147732621,2097152 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,14227582545960589376,3636174909489541533,2097152 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4960,i,15634223351758352556,2223664753142489928,2097152 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5116,i,6103829248846506823,1189242797144220795,2097152 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3807244036453255243,15773272272744162103,524288 --field-trial-handle=2148,i,13886348845725174828,10724380930035889232,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:85⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa281dc188,0x7ffa281dc194,0x7ffa281dc1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,12812962316233796584,2991076635661794909,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:36⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1549860418790159409,14929962525514989794,262144 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,2025959170166219836,13773191145035882903,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15582458771306034274,8826232818210221734,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,15582458771306034274,8826232818210221734,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,3087008301636038239,4540703576552723142,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,14529964520034815362,14234232669779027989,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:86⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,6835414233059781778,11640506479873673113,524288 --field-trial-handle=2352,i,13206188484199512046,1916767398103229755,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:86⤵
-
-
-
-
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\grpconv.exegrpconv -o1⤵
-
C:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exeC:\PROGRA~1\VSREVO~1\REVOUN~1\ruplp.exe -Embedding1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
RevoUninPro.exe
unins000.exe
dispatch.log
package.json
gpu_encoder_helper.exe
app.ico
11a65510aba0d8634f65b15d4b013a6ea7b660f20e58ad61f180d7b4c84348bb
1fda495933d4772d82b239b4a206055881915da06bbb19215c1f0ceac26f2dd4
2fdf368f407b6841a82fb9138e4eae1b2e13e0ec6c4e4baee4dbd010d47bb88b
3d8c695ded31f64fe1261ec5cce642b4c504cda84d79b21ccdc4bd5b5354c756
5bbaac722a74b186f9e99f6e3f91a6fc8f0948aadc7d25ce2e187b22aad2a8a0
6bd9bbf582e4c00bd1ed9acb0aa1610cdc0b3c23a88c32190aae1f1e637beae1
763857b4bbe4e7c322c6100d745a76d37a09db3434005c40785d0bdf451c45be
9c9ce267652fe4ab299b15f5e6bb56ec308fc821b97426ddb54cfead2f0a64a8
a7b9bfa2798f8f706388731b8fb2b77230ac2932c50c4b78936da88a7e096b16
bc9c4c88c93bf1fa79d16f24d9857f5710406a068ad5deefa77dbcbef9862137
c690202e4ec1e6b18a3808f2e0e389f125ec205d4d726863c997e9a05c0bfb3e
ce199ba5e2ff09d7b03b55099d284daf0ed6fd868c8a4e560085aa8fef7b94b3
d3c944a92e4039f42f3cb4f3757a52e6b4422d8428763e1cb2063bb3a66d7f6f
dbd3c2a743b379157f6a6674cc8ede3a94cec47398f2852ad022a133e04d219c
f47f695dbf8744226daddc2cf0784d6c0654c5e398ef8487fe8b0ccadb8f5232
fad6eb34c2e1db6bd214e35bfb280d35a77052c14480f58e6e1cd3a49fb65f30
ff2b584ab1805cd89e48279f12dfb084a66f58df90115a39d60295463b55e7f5
installer.db
installer.db
installer.db
installer.db
RELEASES
RELEASES
settings.dat
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
BrowsingTopicsState
f_000005
f_000006
f_000008
f_00000a
f_000063
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
000003.log
915c5e63-87e1-4282-991d-1447d4e756ca.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe586b38.TMP
the-real-index
the-real-index
the-real-index
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
data_1
Variations
blocklist
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
11468490-7dee-4bab-af53-487cb305cc5f.tmp
f_000094
the-real-index
the-real-index
the-real-index~RFe5cd7f9.TMP
SiteList-Enterprise.json
Edge Profile.ico
60e0b843-2f41-432f-8fad-f993c965b9aa.tmp
Network Persistent State
Network Persistent State
TransportSecurity
Preferences
Preferences
Secure Preferences
Secure Preferences
index.txt
index.txt
index.txt~RFe5cca8b.TMP
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Variations
477b8209-6c28-45ca-b821-605907d88193.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
3a8eadc7-aba9-4595-8731-cfb7422aa114.tmp
72981331-4025-477e-a013-86ae08a8b5ff.tmp
Discord.ruel
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
app-update.yml
app.asar
DummyGame.deps.json
DummyGame.dll
DummyGame.exe
DummyGame.pdb
DummyGame.runtimeconfig.json
elevate.exe
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
SpiderBanner.dll
StdUtils.dll
System.dll
WinShell.dll
nsProcess.dll
nsis7z.dll
5d2ec499-e7c3-4bfb-988b-ab83bd79ce24.tmp
content_new.js
data.lhi
data.lhi
reglogs.dat
RUPLogsData.ini
RUPLogsData.ini
default.dic
230bf886-c044-4b99-8c1e-73304e472193.tmp
CURRENT
Network Persistent State
Network Persistent State~RFe5c264c.TMP
f_000021
f_000048
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
index
the-real-index
the-real-index
settings.dat
data_0
data_0
data_1
data_2
data_3
MANIFEST-000001
1a2cb2cb-386b-4136-9332-ed62ae4ee888.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
abb09d7e-5359-4270-8fe0-038cc42fba3f.tmp
Preferences
Preferences
bc2809b9-0cc2-4941-8207-4b6df4887ce9.tmp
the-real-index
b0a025a0-6b13-4c7d-9b9d-b34d3581a2a9.tmp
d1030441-5848-4ea1-b555-c7d463b88e0d.tmp
the-real-index
index.txt
index.txt
index.txt
c935f281-cc26-462e-aadb-1f52a6e3f54a.tmp
index.txt
index.txt
c19dd456-f7c4-48bd-a151-9b1315da6600.tmp
index.txt
index.txt
badge-1.ico
badge-10.ico
badge-11.ico
badge-2.ico
badge-3.ico
badge-4.ico
badge-5.ico
badge-6.ico
badge-7.ico
badge-8.ico
badge-9.ico
discord-last-webrtc_0
renderer_js.log
scope_v3.json
scope_v3.json
settings.json
settings.json
settings.json
settings.json
Unconfirmed 166546.crdownload
revoflt.sys
memory/1716-2059-0x0000000006430000-0x00000000064C2000-memory.dmp
memory/1716-1996-0x00000000082B0000-0x00000000082BE000-memory.dmp
memory/1716-1995-0x00000000082D0000-0x0000000008308000-memory.dmp
memory/1716-1994-0x0000000007A50000-0x0000000007A58000-memory.dmp
memory/1716-1807-0x00000000002B0000-0x000000000043A000-memory.dmp
memory/2252-2003-0x0000000005390000-0x00000000053B0000-memory.dmp
memory/3052-1673-0x00007FFA52E40000-0x00007FFA52E41000-memory.dmp
memory/3052-1672-0x00007FFA535F0000-0x00007FFA535F1000-memory.dmp
memory/3868-339-0x0000024289910000-0x0000024289920000-memory.dmp
memory/3868-195-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-328-0x0000024289860000-0x0000024289870000-memory.dmp
memory/3868-327-0x0000024289850000-0x0000024289860000-memory.dmp
memory/3868-325-0x00000242895D0000-0x0000024289840000-memory.dmp
memory/3868-202-0x0000024289980000-0x0000024289990000-memory.dmp
memory/3868-335-0x00000242898D0000-0x00000242898E0000-memory.dmp
memory/3868-178-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-171-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-16-0x00000242895D0000-0x0000024289840000-memory.dmp
memory/3868-26-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-30-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-33-0x0000024289840000-0x0000024289850000-memory.dmp
memory/3868-35-0x0000024289850000-0x0000024289860000-memory.dmp
memory/3868-37-0x0000024289860000-0x0000024289870000-memory.dmp
memory/3868-39-0x0000024289870000-0x0000024289880000-memory.dmp
memory/3868-167-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-326-0x0000024289840000-0x0000024289850000-memory.dmp
memory/3868-80-0x0000024289960000-0x0000024289970000-memory.dmp
memory/3868-155-0x0000024289970000-0x0000024289980000-memory.dmp
memory/3868-141-0x0000024289960000-0x0000024289970000-memory.dmp
memory/3868-140-0x0000024289950000-0x0000024289960000-memory.dmp
memory/3868-133-0x0000024289940000-0x0000024289950000-memory.dmp
memory/3868-132-0x0000024289930000-0x0000024289940000-memory.dmp
memory/3868-129-0x0000024289920000-0x0000024289930000-memory.dmp
memory/3868-109-0x0000024289910000-0x0000024289920000-memory.dmp
memory/3868-96-0x0000024289900000-0x0000024289910000-memory.dmp
memory/3868-93-0x00000242898F0000-0x0000024289900000-memory.dmp
memory/3868-329-0x0000024289870000-0x0000024289880000-memory.dmp
memory/3868-324-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-330-0x0000024289880000-0x0000024289890000-memory.dmp
memory/3868-92-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-224-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-318-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-323-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-42-0x0000024289880000-0x0000024289890000-memory.dmp
memory/3868-43-0x0000024289890000-0x00000242898A0000-memory.dmp
memory/3868-45-0x00000242898A0000-0x00000242898B0000-memory.dmp
memory/3868-47-0x00000242898B0000-0x00000242898C0000-memory.dmp
memory/3868-50-0x00000242898C0000-0x00000242898D0000-memory.dmp
memory/3868-49-0x00000242895D0000-0x0000024289840000-memory.dmp
memory/3868-52-0x00000242898D0000-0x00000242898E0000-memory.dmp
memory/3868-54-0x0000024289840000-0x0000024289850000-memory.dmp
memory/3868-55-0x00000242898E0000-0x00000242898F0000-memory.dmp
memory/3868-86-0x00000242898E0000-0x00000242898F0000-memory.dmp
memory/3868-87-0x0000024289980000-0x0000024289990000-memory.dmp
memory/3868-83-0x00000242898D0000-0x00000242898E0000-memory.dmp
memory/3868-84-0x0000024289970000-0x0000024289980000-memory.dmp
memory/3868-58-0x00000242898F0000-0x0000024289900000-memory.dmp
memory/3868-346-0x0000024289980000-0x0000024289990000-memory.dmp
memory/3868-345-0x0000024289970000-0x0000024289980000-memory.dmp
memory/3868-344-0x0000024289960000-0x0000024289970000-memory.dmp
memory/3868-343-0x0000024289950000-0x0000024289960000-memory.dmp
memory/3868-342-0x0000024289940000-0x0000024289950000-memory.dmp
memory/3868-341-0x0000024289930000-0x0000024289940000-memory.dmp
memory/3868-57-0x0000024289850000-0x0000024289860000-memory.dmp
memory/3868-340-0x0000024289920000-0x0000024289930000-memory.dmp
memory/3868-61-0x0000024289900000-0x0000024289910000-memory.dmp
memory/3868-336-0x00000242898E0000-0x00000242898F0000-memory.dmp
memory/3868-337-0x00000242898F0000-0x0000024289900000-memory.dmp
memory/3868-338-0x0000024289900000-0x0000024289910000-memory.dmp
memory/3868-223-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-158-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-334-0x00000242898C0000-0x00000242898D0000-memory.dmp
memory/3868-333-0x00000242898B0000-0x00000242898C0000-memory.dmp
memory/3868-332-0x00000242898A0000-0x00000242898B0000-memory.dmp
memory/3868-60-0x0000024289860000-0x0000024289870000-memory.dmp
memory/3868-331-0x0000024289890000-0x00000242898A0000-memory.dmp
memory/3868-63-0x0000024287F80000-0x0000024287F81000-memory.dmp
memory/3868-65-0x0000024289910000-0x0000024289920000-memory.dmp
memory/3868-64-0x0000024289870000-0x0000024289880000-memory.dmp
memory/3868-67-0x0000024289880000-0x0000024289890000-memory.dmp
memory/3868-68-0x0000024289920000-0x0000024289930000-memory.dmp
memory/3868-72-0x0000024289930000-0x0000024289940000-memory.dmp
memory/3868-71-0x0000024289890000-0x00000242898A0000-memory.dmp
memory/3868-73-0x00000242898A0000-0x00000242898B0000-memory.dmp
memory/3868-79-0x00000242898C0000-0x00000242898D0000-memory.dmp
memory/3868-76-0x00000242898B0000-0x00000242898C0000-memory.dmp
memory/3868-77-0x0000024289950000-0x0000024289960000-memory.dmp
memory/3868-74-0x0000024289940000-0x0000024289950000-memory.dmp
memory/4592-12-0x000001FAA7780000-0x000001FAA7781000-memory.dmp
memory/4592-13-0x000001FAA77A0000-0x000001FAA7A10000-memory.dmp
memory/4592-2-0x000001FAA77A0000-0x000001FAA7A10000-memory.dmp
memory/4760-8464-0x0000016F657E0000-0x0000016F67061000-memory.dmp
memory/4760-8397-0x0000016F657E0000-0x0000016F67061000-memory.dmp
memory/5236-8790-0x0000000000400000-0x000000000043A000-memory.dmp
memory/5236-9123-0x0000000000400000-0x000000000043A000-memory.dmp
memory/5236-8815-0x0000000000400000-0x000000000043A000-memory.dmp
memory/5304-5630-0x00007FFA52E40000-0x00007FFA52E41000-memory.dmp
memory/5304-5629-0x00007FFA535F0000-0x00007FFA535F1000-memory.dmp
memory/5784-9107-0x0000000000400000-0x0000000000E32000-memory.dmp
memory/6224-9115-0x0000000000400000-0x0000000000540000-memory.dmp
memory/6224-9100-0x0000000000400000-0x0000000000540000-memory.dmp
memory/6224-8816-0x0000000000400000-0x0000000000540000-memory.dmp
memory/6224-8830-0x0000000000400000-0x0000000000540000-memory.dmp
memory/6224-8818-0x0000000000400000-0x0000000000540000-memory.dmp
memory/6740-9114-0x0000000000400000-0x0000000000E32000-memory.dmp
memory/6760-4991-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4977-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4989-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4978-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4979-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4988-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4986-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4990-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4985-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/6760-4987-0x000001D3C2520000-0x000001D3C2521000-memory.dmp
memory/7924-5565-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5571-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5564-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5570-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5566-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5572-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5573-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5574-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/7924-5575-0x0000029943B30000-0x0000029943B31000-memory.dmp
memory/8136-7497-0x000002791DA40000-0x000002791DA50000-memory.dmp
memory/8136-7516-0x000002792DD70000-0x000002792DD71000-memory.dmp
memory/8136-7517-0x000002792DE80000-0x000002792DE81000-memory.dmp
memory/8136-7513-0x000002792DD40000-0x000002792DD41000-memory.dmp
memory/8136-7515-0x000002792DD70000-0x000002792DD71000-memory.dmp
memory/8136-7481-0x000002791D940000-0x000002791D950000-memory.dmp