hxxps://workupload[.]com/file/Bkqc9Wb5SpJ

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	Mod Cleaner Studio.exe

Executes dropped EXE 19 IoCs

pid	Process
5260	Mod Cleaner Studio Portable.exe
5572	Mod Cleaner Studio Portable.exe
5888	Mod Cleaner Studio Portable.exe
7032	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
6044	Mod Cleaner Studio.exe
6380	Mod Cleaner Studio.exe
6664	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
6892	Mod Cleaner Studio.exe
7008	Mod Cleaner Studio.exe
1708	Mod Cleaner Studio.exe
4724	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
3784	Mod Cleaner Studio.exe
4268	Mod Cleaner Studio.exe
5900	Mod Cleaner Studio.exe
7868	Mod Cleaner Studio.exe
1076	Mod Cleaner Studio.exe

Loads dropped DLL 44 IoCs

pid	Process
5260	Mod Cleaner Studio Portable.exe
5260	Mod Cleaner Studio Portable.exe
5572	Mod Cleaner Studio Portable.exe
5572	Mod Cleaner Studio Portable.exe
5888	Mod Cleaner Studio Portable.exe
5888	Mod Cleaner Studio Portable.exe
5260	Mod Cleaner Studio Portable.exe
7032	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
6044	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
5764	Mod Cleaner Studio.exe
6380	Mod Cleaner Studio.exe
5572	Mod Cleaner Studio Portable.exe
5888	Mod Cleaner Studio Portable.exe
5572	Mod Cleaner Studio Portable.exe
6664	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
6892	Mod Cleaner Studio.exe
7008	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
6932	Mod Cleaner Studio.exe
1708	Mod Cleaner Studio.exe
5888	Mod Cleaner Studio Portable.exe
4724	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
6896	Mod Cleaner Studio.exe
3784	Mod Cleaner Studio.exe
4268	Mod Cleaner Studio.exe
5900	Mod Cleaner Studio.exe
7868	Mod Cleaner Studio.exe
7868	Mod Cleaner Studio.exe
1076	Mod Cleaner Studio.exe
1076	Mod Cleaner Studio.exe

Queries registry keys for unique system GUIDs 1 TTPs 25 IoCs

Queries the MachineGuid or HwProfileGuid value from the command line, commonly used to create a unique victim ID.

System Information Discovery

pid	Process
3688	reg.exe
7560	reg.exe
7636	reg.exe
7824	reg.exe
8148	reg.exe
4636	reg.exe
6128	reg.exe
5340	reg.exe
4260	reg.exe
7876	reg.exe
7372	reg.exe
6120	reg.exe
5184	reg.exe
5532	reg.exe
8184	reg.exe
4900	reg.exe
6128	reg.exe
7780	reg.exe
7344	reg.exe
4420	reg.exe
5340	reg.exe
7196	reg.exe
7480	reg.exe
7732	reg.exe
7212	reg.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 30 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
7492	cmd.exe
6516	cmd.exe
756	cmd.exe
7676	cmd.exe
7304	cmd.exe
5236	cmd.exe
5712	cmd.exe
1172	cmd.exe
6764	cmd.exe
6392	cmd.exe
1448	cmd.exe
7620	cmd.exe
6032	cmd.exe
7424	cmd.exe
7764	cmd.exe
5820	cmd.exe
5364	cmd.exe
5740	cmd.exe
3528	cmd.exe
6440	cmd.exe
5956	cmd.exe
6164	cmd.exe
6776	cmd.exe
7204	cmd.exe
1656	cmd.exe
8144	cmd.exe
2444	cmd.exe
176	cmd.exe
8140	cmd.exe
8160	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 12 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Mod Cleaner Studio.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Mod Cleaner Studio.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mod Cleaner Studio Portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mod Cleaner Studio Portable.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Mod Cleaner Studio Portable.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
3692	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{DF2E3CFB-1FF0-4DFB-A61A-ACCED5D04E75}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
7296	msedge.exe
7296	msedge.exe
7868	Mod Cleaner Studio.exe
7868	Mod Cleaner Studio.exe
1076	Mod Cleaner Studio.exe
1076	Mod Cleaner Studio.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	5260	Mod Cleaner Studio Portable.exe
Token: SeSecurityPrivilege	5572	Mod Cleaner Studio Portable.exe
Token: SeSecurityPrivilege	5888	Mod Cleaner Studio Portable.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeSecurityPrivilege	5572	Mod Cleaner Studio Portable.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeSecurityPrivilege	5888	Mod Cleaner Studio Portable.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	6664	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	6664	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	6664	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	6664	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	6664	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	6664	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	6664	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	6664	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	7032	Mod Cleaner Studio.exe
Token: SeCreatePagefilePrivilege	7032	Mod Cleaner Studio.exe
Token: SeShutdownPrivilege	6664	Mod Cleaner Studio.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
7032	Mod Cleaner Studio.exe
6664	Mod Cleaner Studio.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 48 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2476	4620	msedge.exe	85
PID 4620 wrote to memory of 3692	4620	msedge.exe	86
PID 4620 wrote to memory of 4856	4620	msedge.exe	87
PID 4620 wrote to memory of 4856	4620	msedge.exe	87
PID 4620 wrote to memory of 4856	4620	msedge.exe	87
PID 4620 wrote to memory of 3524	4620	msedge.exe	88
PID 4620 wrote to memory of 3524	4620	msedge.exe	88
PID 4620 wrote to memory of 1400	4620	msedge.exe	90
PID 4620 wrote to memory of 3204	4620	msedge.exe	91
PID 4620 wrote to memory of 1400	4620	msedge.exe	90
PID 4620 wrote to memory of 1400	4620	msedge.exe	90
PID 4620 wrote to memory of 3204	4620	msedge.exe	91
PID 4620 wrote to memory of 3204	4620	msedge.exe	91
PID 4620 wrote to memory of 4824	4620	msedge.exe	92
PID 4620 wrote to memory of 4824	4620	msedge.exe	92
PID 4620 wrote to memory of 4824	4620	msedge.exe	92
PID 4620 wrote to memory of 3648	4620	msedge.exe	93
PID 4620 wrote to memory of 3648	4620	msedge.exe	93
PID 4620 wrote to memory of 3648	4620	msedge.exe	93
PID 4620 wrote to memory of 1716	4620	msedge.exe	99
PID 4620 wrote to memory of 4512	4620	msedge.exe	100
PID 4620 wrote to memory of 1716	4620	msedge.exe	99
PID 4620 wrote to memory of 4512	4620	msedge.exe	100
PID 4620 wrote to memory of 4568	4620	msedge.exe	102
PID 4620 wrote to memory of 864	4620	msedge.exe	105
PID 4620 wrote to memory of 2156	4620	msedge.exe	106
PID 4620 wrote to memory of 864	4620	msedge.exe	105
PID 4620 wrote to memory of 2156	4620	msedge.exe	106
PID 4620 wrote to memory of 2156	4620	msedge.exe	106
PID 4620 wrote to memory of 4208	4620	msedge.exe	111
PID 4620 wrote to memory of 5260	4620	msedge.exe	116
PID 4620 wrote to memory of 5572	4620	msedge.exe	120
PID 4620 wrote to memory of 5328	4620	msedge.exe	123
PID 4620 wrote to memory of 4376	4620	msedge.exe	124
PID 4620 wrote to memory of 3528	4620	msedge.exe	125
PID 4620 wrote to memory of 5888	4620	msedge.exe	126
PID 5260 wrote to memory of 7032	5260	Mod Cleaner Studio Portable.exe	127
PID 7032 wrote to memory of 5764	7032	Mod Cleaner Studio.exe	128
PID 7032 wrote to memory of 5764	7032	Mod Cleaner Studio.exe	128
PID 7032 wrote to memory of 6044	7032	Mod Cleaner Studio.exe	129
PID 7032 wrote to memory of 6380	7032	Mod Cleaner Studio.exe	130
PID 7032 wrote to memory of 6380	7032	Mod Cleaner Studio.exe	130
PID 7032 wrote to memory of 5820	7032	Mod Cleaner Studio.exe	132
PID 5820 wrote to memory of 1980	5820	cmd.exe	134
PID 7032 wrote to memory of 1172	7032	Mod Cleaner Studio.exe	135
PID 1172 wrote to memory of 6120	1172	cmd.exe	137
PID 4620 wrote to memory of 5204	4620	msedge.exe	138
PID 4620 wrote to memory of 5204	4620	msedge.exe	138
PID 5572 wrote to memory of 6664	5572	Mod Cleaner Studio Portable.exe	139
PID 6664 wrote to memory of 6932	6664	Mod Cleaner Studio.exe	140
PID 6664 wrote to memory of 6932	6664	Mod Cleaner Studio.exe	140
PID 6664 wrote to memory of 6892	6664	Mod Cleaner Studio.exe	141
PID 6664 wrote to memory of 1708	6664	Mod Cleaner Studio.exe	142
PID 6664 wrote to memory of 1708	6664	Mod Cleaner Studio.exe	142
PID 6664 wrote to memory of 7008	6664	Mod Cleaner Studio.exe	143
PID 6664 wrote to memory of 7008	6664	Mod Cleaner Studio.exe	143
PID 6664 wrote to memory of 6032	6664	Mod Cleaner Studio.exe	144
PID 6032 wrote to memory of 4900	6032	cmd.exe	146
PID 6664 wrote to memory of 6516	6664	Mod Cleaner Studio.exe	148
PID 6516 wrote to memory of 4420	6516	cmd.exe	150
PID 6664 wrote to memory of 1656	6664	Mod Cleaner Studio.exe	151
PID 1656 wrote to memory of 5124	1656	cmd.exe	153
PID 6664 wrote to memory of 5364	6664	Mod Cleaner Studio.exe	154
PID 5364 wrote to memory of 5184	5364	cmd.exe	156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://workupload.com/file/Bkqc9Wb5SpJ
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffac585c188,0x7ffac585c194,0x7ffac585c1a0
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,7793812294444671324,8491639320250085640,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15726252359065700304,14719007495785491055,262144 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,9309282862420447920,8372838936822713927,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7372790917027447404,12154781516462933843,2097152 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,12797853231777390559,5738829473478672490,2097152 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,693548749524365512,6682795295201200344,2097152 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7402431834912402529,7701662789663558502,2097152 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,3994972031329434186,10594150317761112682,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,8845582308056630800,5961870180248420681,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,4296270952787425087,6500136040600984552,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,4296270952787425087,6500136040600984552,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,8227232269420316413,4421580631281180792,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6304,i,15458425114943763127,76530198994924906,2097152 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,203820205589163333,12347571815166730481,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4208
- C:\Users\Admin\Downloads\Mod Cleaner Studio Portable.exe
  "C:\Users\Admin\Downloads\Mod Cleaner Studio Portable.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
    "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1756,i,12292975971677964200,10880682095257431236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5764
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --field-trial-handle=2340,i,12292975971677964200,10880682095257431236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --app-path="C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2700,i,12292975971677964200,10880682095257431236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:6380
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5820
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        
        java -version
        5⤵
        
        PID:1980
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1172
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:6120
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:5956
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5532
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:6392
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7492
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7560
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:176
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7876
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3508,i,12292975971677964200,10880682095257431236,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:7868
- C:\Users\Admin\Downloads\Mod Cleaner Studio Portable.exe
  "C:\Users\Admin\Downloads\Mod Cleaner Studio Portable.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5572
- - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
    "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1752,i,8075165423558433698,8250375707808005096,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1648 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6932
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --field-trial-handle=2296,i,8075165423558433698,8250375707808005096,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --app-path="C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2672,i,8075165423558433698,8250375707808005096,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --app-path="C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,8075165423558433698,8250375707808005096,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:7008
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6032
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        
        java -version
        5⤵
        
        PID:4900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:6516
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:4420
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:1656
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        
        java -version
        5⤵
        
        PID:5124
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:5364
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:8144
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:8184
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:2444
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:4260
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:1448
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7196
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7424
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7480
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7764
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:6128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:3528
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7824
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:6776
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:4636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:6440
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7212
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=884,i,8075165423558433698,8250375707808005096,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6076662754998816342,10372512385666918353,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,3216190678408478614,12968206271955686794,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,1580147403141577357,4336517507680054537,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  PID:3528
- C:\Users\Admin\Downloads\Mod Cleaner Studio Portable.exe
  "C:\Users\Admin\Downloads\Mod Cleaner Studio Portable.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5888
- - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
    "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Reads the TCP/IP host and domain name from the registry
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1740,i,14364234397430481627,16305895138332393335,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1732 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --field-trial-handle=2444,i,14364234397430481627,16305895138332393335,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --app-path="C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2596,i,14364234397430481627,16305895138332393335,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:4268
  - - C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe
      "C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\Mod Cleaner Studio.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\mod-cleaner-studio" --app-path="C:\Users\Admin\AppData\Local\Temp\3JpMn4le1e26hYZIwYrLv6eX1Ds\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2816,i,14364234397430481627,16305895138332393335,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:5900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:6764
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        
        java -version
        5⤵
        
        PID:4576
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "java -version 2>&1"
      4⤵
      Executes a command shell one-liner
      PID:756
    - - C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
        
        java -version
        5⤵
        
        PID:6828
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:5236
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:6128
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:6164
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:5340
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:5740
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:3688
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:5712
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:4900
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7620
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7636
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7676
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7732
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:8140
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:8148
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:8160
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7780
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7204
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7344
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /d /s /c "reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid"
      4⤵
      Executes a command shell one-liner
      PID:7304
    - - C:\Windows\system32\reg.exe
        
        reg query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography" /v MachineGuid
        5⤵
        Queries registry keys for unique system GUIDs
        
        PID:7372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,3924076195551854881,17535201526107162613,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5648,i,3235174274668933821,17612171710460463626,2097152 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:6652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,687305612208354154,5442753720116011252,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6860,i,11704862161812502266,272627493312071846,262144 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:7296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,13511481758079631631,9399904384765230231,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,2721115352783771034,13812219646807838175,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,3609808965535683809,12386203079367132002,524288 --field-trial-handle=2180,i,4393783491220447063,17095602986905029139,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:4584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery