Resubmissions
10/04/2024, 12:56
240410-p6qpgagd79110/04/2024, 12:39
240410-pv43qaba8s708/04/2024, 16:21
240408-ttseradf78106/04/2024, 08:39
240406-kkr8ysfc55606/04/2024, 08:38
240406-kjv88aee2y06/04/2024, 08:14
240406-j4467aeb4x1006/04/2024, 08:05
240406-jyx6paeg548Analysis
- max time kernel
1046s - max time network
1040s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/04/2024, 08:14
General
- Target https://bing.com
- Sample240406-j4467aeb4x
Malware Config
Extracted
-
lumma
-
https://handbreeadretwaiw.shop/api
-
https://birdpenallitysydw.shop/api
-
https://cinemaclinicttanwk.shop/api
-
https://disagreemenywyws.shop/api
-
https://speedparticipatewo.shop/api
-
https://fixturewordbakewos.shop/api
-
https://colorprioritytubbew.shop/api
-
https://abuselinenaidwjuew.shop/api
-
https://methodgreenglassdatw.shop/api
Signatures
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 56 IoCs
- Suspicious behavior: GetForegroundWindowSpam 3 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\SysWOW64\dialer.exe"C:\Windows\system32\dialer.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bing.com1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ccd546f8,0x7ff8ccd54708,0x7ff8ccd547182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4520 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4024 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\ExpLauncher_v5.3.7.7z"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4660 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6828 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7148 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2180,3352254306775524088,9778414299158229543,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6744 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\TrustLauncher.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SDRSVC1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\Launcher.exe"C:\Users\Admin\Desktop\Launcher.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 5923⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4232 -s 5963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4232 -ip 42321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 4232 -ip 42321⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.0.1381227049\278630423" -parentBuildID 20221007134813 -prefsHandle 1900 -prefMapHandle 1892 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {092ae147-a07d-484a-a772-42b42abebf35} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 1980 1e197ffd958 gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.1.2007475623\1535290164" -parentBuildID 20221007134813 -prefsHandle 2368 -prefMapHandle 2364 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8de7bfd-4d62-42a6-8587-64d319b42183} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 2380 1e18b772b58 socket3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.2.1647262670\1968979903" -childID 1 -isForBrowser -prefsHandle 3188 -prefMapHandle 3184 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd03b351-7aa0-4d61-b97f-680de08dafd1} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 3196 1e19c0a6658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.3.1792294461\411161546" -childID 2 -isForBrowser -prefsHandle 2536 -prefMapHandle 1316 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd99bf41-7bc7-443f-ba57-64c8c363cb27} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 3604 1e18b762258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.4.1174008965\679129460" -childID 3 -isForBrowser -prefsHandle 4704 -prefMapHandle 4692 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c29cde02-9b57-48fe-8836-89a808e158ba} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 4716 1e19de26058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.5.1954180788\2053665493" -childID 4 -isForBrowser -prefsHandle 5084 -prefMapHandle 5032 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6012f368-9730-42b2-a6a1-4f706a593e36} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5076 1e19c061058 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.6.1612014624\960347200" -childID 5 -isForBrowser -prefsHandle 5380 -prefMapHandle 5376 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {54f32fd7-3f3c-4d5b-9131-049654cf8ecc} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5328 1e19c061958 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.7.1454051266\334029707" -childID 6 -isForBrowser -prefsHandle 5428 -prefMapHandle 5432 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3714d4c8-e7e7-46f0-b0bb-20cd311bc10b} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5420 1e19c05fe58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.8.1690516821\42438884" -childID 7 -isForBrowser -prefsHandle 6004 -prefMapHandle 5996 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8703e6ed-bfa7-4b6d-b572-1ca24574651a} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6016 1e1a0495458 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.9.2123188386\1721332975" -childID 8 -isForBrowser -prefsHandle 6700 -prefMapHandle 7432 -prefsLen 26725 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a42452b-d2b1-46ee-940d-75c687bda868} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7396 1e19e680758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.10.929287256\1073072336" -childID 9 -isForBrowser -prefsHandle 7352 -prefMapHandle 6976 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32b6c1e3-e1cb-4571-ae0e-2af779b4d47f} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7424 1e19e681658 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.11.1709013051\1441693537" -childID 10 -isForBrowser -prefsHandle 7308 -prefMapHandle 6836 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1899335c-543b-4b77-bbe6-0d4334f8ed65} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7332 1e19c062258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.12.1997545077\1616618297" -childID 11 -isForBrowser -prefsHandle 6148 -prefMapHandle 6164 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a4b69a1-8658-425f-b049-977231fe4aaf} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6160 1e18b764d58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.13.1888962745\202900918" -childID 12 -isForBrowser -prefsHandle 6248 -prefMapHandle 6196 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12eded9e-7291-45bd-b518-99a446732172} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6888 1e19c009158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.14.326541376\1561421827" -childID 13 -isForBrowser -prefsHandle 6776 -prefMapHandle 7028 -prefsLen 27425 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c56eb66a-c807-49af-a990-fad0dc34e6ad} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 4140 1e19c8f8b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.15.1913703397\1334198287" -childID 14 -isForBrowser -prefsHandle 6648 -prefMapHandle 7324 -prefsLen 27434 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f0957a7-26f6-4554-8d26-08dec82f7f4f} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7312 1e1a0c13558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.16.1820795362\165850194" -childID 15 -isForBrowser -prefsHandle 4056 -prefMapHandle 5624 -prefsLen 27434 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2fa6261-bdec-4108-8553-ad549ac792e9} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 1640 1e1a184cb58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.17.1799549360\645815638" -childID 16 -isForBrowser -prefsHandle 6832 -prefMapHandle 6036 -prefsLen 27434 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d59bbe02-4b61-4068-8e01-b069ecec1f5f} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7316 1e19acefc58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.18.555866597\1411095191" -childID 17 -isForBrowser -prefsHandle 6876 -prefMapHandle 6008 -prefsLen 27434 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {202fcb95-41c8-4f12-8ef1-8ffec2e29596} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6856 1e19cf75b58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.19.1110534642\150035191" -childID 18 -isForBrowser -prefsHandle 6888 -prefMapHandle 6160 -prefsLen 27434 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eef97bbd-8168-4bc7-88eb-8fc62d6293d9} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6980 1e19e650e58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.20.1216570828\850626329" -childID 19 -isForBrowser -prefsHandle 2720 -prefMapHandle 5240 -prefsLen 27443 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {435e0f8d-b43b-4ecb-97b6-7b43029ba888} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5740 1e1a184cb58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.21.81514249\1913810502" -childID 20 -isForBrowser -prefsHandle 6184 -prefMapHandle 7040 -prefsLen 27443 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {569c1a6f-b3c5-42f6-9934-cf67bd4c8e38} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7232 1e1a184c258 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.22.1802186076\1538040864" -parentBuildID 20221007134813 -prefsHandle 4772 -prefMapHandle 7652 -prefsLen 27443 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca9ede66-86c9-4304-b690-d160892a939c} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6980 1e1a1113058 rdd3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.23.643033755\192256741" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 7856 -prefMapHandle 7852 -prefsLen 27443 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {30a684fc-c7d8-4746-b5b9-f1653f954ca4} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7860 1e1a1114b58 utility3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.24.933913942\1890339872" -childID 21 -isForBrowser -prefsHandle 8064 -prefMapHandle 8060 -prefsLen 27443 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0809b670-d43f-4948-b6d7-628218e47318} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 8072 1e1a1086158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.25.2062927734\1200297516" -childID 22 -isForBrowser -prefsHandle 4140 -prefMapHandle 8100 -prefsLen 27452 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec073814-ad73-4975-aee4-a4913141c813} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7108 1e1a10ada58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.26.977872458\1519906900" -childID 23 -isForBrowser -prefsHandle 8456 -prefMapHandle 8480 -prefsLen 27452 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {afd39a51-8bbd-4b4e-8a1e-61eb8d827d85} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 9164 1e1a10dfe58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.27.1033594963\850701453" -childID 24 -isForBrowser -prefsHandle 8480 -prefMapHandle 7728 -prefsLen 27461 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6fbc054-5881-4549-b3cb-97b5f1b42b37} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 8380 1e1a03e7558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.28.1041959224\1987508448" -childID 25 -isForBrowser -prefsHandle 8276 -prefMapHandle 8212 -prefsLen 27461 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65f1210e-5ed9-4f3e-8413-7deed9fd395c} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 8156 1e18b75e558 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.29.192743804\117969400" -childID 26 -isForBrowser -prefsHandle 8360 -prefMapHandle 8976 -prefsLen 27461 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {51f35be9-5a93-47d3-894b-5b6c1ee4e8e3} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 5424 1e19c009758 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.30.1973930779\1108449928" -childID 27 -isForBrowser -prefsHandle 6148 -prefMapHandle 408 -prefsLen 27613 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd729375-0f13-486c-a946-f9cc02837cc6} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 7276 1e18b76ab58 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.31.1330988411\1500567371" -childID 28 -isForBrowser -prefsHandle 7744 -prefMapHandle 6880 -prefsLen 27613 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {443b5c16-b342-4af1-bf01-6e2da68125d9} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 6868 1e19fc40158 tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="5044.32.1977802825\1730339622" -childID 29 -isForBrowser -prefsHandle 8564 -prefMapHandle 8576 -prefsLen 27613 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d63fdbe-a7eb-446e-b6a9-9220466f26ba} 5044 "\\.\pipe\gecko-crash-server-pipe.5044" 9172 1e1a10af858 tab3⤵
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2f4 0x49c1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Desktop\TrustLauncher.exe"C:\Users\Admin\Desktop\TrustLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
-
-
C:\Users\Admin\Desktop\TrustLauncher.exe"C:\Users\Admin\Desktop\TrustLauncher.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exeC:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe2⤵
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
7c23ae7a-4147-4e9d-bdf3-ce516bf8a224.tmp
f_00000a
f_00000b
f_00000c
f_000011
f_000016
f_000024
f_000025
f_000026
f_000028
f_000029
f_00002a
f_00002b
f_00002c
the-real-index
the-real-index
Cookies
History
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
index
the-real-index
the-real-index~RFe60e64d.TMP
the-real-index
the-real-index
the-real-index~RFe608ee6.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
CURRENT
the-real-index
the-real-index~RFe60e081.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe578df8.TMP
CURRENT
Local State
Local State
Local State
Local State
Local State
Local State
13060
2056
21378
2497
29070
4955
2E4F0C8E506B148C0BD72B6B77873333D420559C
454ECCE1F07539A24113DA4C99024F6E0DDB5D82
6361286EE523E4F3D0F0EC48A620E7F96B722CE0
63A04CB438F7B48A64E3DB6F28A098B1D358267F
67E978F9E34ACFE2356CA1BF06938719E5E96FCD
75E538799C895A326B1748F01DC62C685C292CB7
75F7F28DE4DA14280A596091EDBD41A92A44336B
7CF7B51FBEFFC7BC13E5DA0FDD4D7E75DA40B509
9DF701A451468135E3C2FDE58AF3412249D36539
A51110DC71FC1AB1DFD589C095972EE031A8A588
B14DCD85E5525990B9B56D5F10E8B1BB7F97CBE8
BA69B158DA8D870EEC5A4390EA1A003604A4BB35
C8015AE422AD27CBD0AE86FA8C2E21C8F26B0BEF
E11659C97B61E224F3238C42FB6FE2A796497661
EDFE3B4A24F9A316106FD168020CBA388A7B4F88
F32BE1E0D9A2F58C95934482E85724511ABB297A
qN9_0jWLttRYPSoe1cJGOA==.ico
JSByteCodeCache_64
StoreLogo.png
wide310x150logo.scale-400.png
settings-mobile.css
SplashScreen.scale-100.png
tokens_deDE.xml
tokens_enUS.xml
tokens_frFR.xml
tokens_itIT.xml
tokens_ptBR.xml
tokens_zhCN.xml
tokens_enGB.xml
tokens_esMX.xml
tokens_enAU.xml
tokens_esES.xml
tokens_frCA.xml
tokens_enCA.xml
tokens_enIN.xml
AppListIcon.targetsize-16.png
AppListIcon.targetsize-20.png
AppListIcon.targetsize-24.png
AppListIcon.targetsize-256.png
AppListIcon.targetsize-32.png
AppListIcon.targetsize-40.png
AppListIcon.targetsize-48.png
AppListIcon.targetsize-64.png
AppListIcon.targetsize-80.png
AppListIcon.targetsize-96.png
SplashScreen.png
Square44x44Logo.targetsize-44_altform-unplated_contrast-black.png
Square44x44Logo.targetsize-44_contrast-white.png
squaretile-sdk.png
SplashScreen.scale-100.png
WideLogo310x150.scale-400.png
StoreLogo.scale-100.png
SmallLogo.scale-100.png
NarratorUWPSquare44x44Logo.targetsize-16_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-20_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-24_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-256_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-30_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-32_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-36_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-40_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-48_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-60_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-64_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-72_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-80_altform-unplated_contrast-black.png
NarratorUWPSquare44x44Logo.targetsize-96_altform-unplated_contrast-black.png
tmpaddon
tmpaddon-1
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
6824f4a902c78fbd.customDestinations-ms
data.safe.bin
events
0ff94841-59a7-4168-8906-43cfc897b8a5
1ab75d64-096e-4577-a358-18f8c23cd671
gmpopenh264.dll
gmpopenh264.info
LICENSE.txt
manifest.json
widevinecdm.dll
widevinecdm.dll.lib
widevinecdm.dll.sig
key4.db
logins-backup.json
prefs-1.js
prefs-1.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
prefs.js
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
recovery.jsonlz4
{89f78c18-662f-4a93-bcab-7aec9d5cd900}.final
{43b8c044-8047-4e61-a5cd-bfcb0f8da364}.final
{5f3973ca-4935-478e-9cef-68c3b8162869}.final
{681bc661-d980-4fcc-8158-9049cadb416a}.final
{2ce5d7d5-856b-446a-97b6-409a908b816c}.final
{32ebec6f-f757-4d7a-b7e4-f42f371ed46c}.final
{b89c17e1-0ce2-4adc-9156-aa77e1689978}.final
{4cc35127-85a5-4e02-8d44-cbc447e3727a}.final
{bf37422d-d4f7-4187-bdcc-1eb73221960c}.final
{38de608a-df49-48d1-81fc-e1fcca254d83}.final
{369b826d-3e9c-4ec7-97c1-60cb1ccc2388}.final
{8e9425f8-265b-403c-9a62-ff9ffd52408f}.final
{5d6419fb-a474-431e-a9e1-65839f3f1d90}.final
{7251e7f0-24ee-4151-b547-e37b068e4397}.final
{5d5c9be4-5452-4af3-9256-1c0f0ec19f98}.final
{4edad8dc-6445-49ad-94e9-c7b003cc139e}.final
{2f0e87ae-eda1-4be1-a64b-f269d7663a9f}.final
{779b1b1a-a44b-4303-8348-784861ee3ea3}.final
{74df3914-c84e-40a8-85ae-89b5317ca810}.final
{89a87460-8eff-43a2-abb5-7d1712af50aa}.final
{ae6042f4-84dd-481b-a1e0-e04e0b5cebaa}.final
{a56b6728-ab29-4a74-9a2d-f5f24d1d36b1}.final
{911e62f2-0a4a-4f5f-839d-c30e76be7cb4}.final
{a36a6335-b570-4b6f-8cd4-8266265ccbb5}.final
{c50450d2-ede6-40d8-b31a-e836333dc0b6}.final
{a83e938e-9cc1-463c-a2b8-575f0a045ebb}.final
{f8b5a727-f2e1-4fc1-9e3b-93123073b6bc}.final
{8473af9f-0b13-4f40-bdd3-0a4f606211bd}.final
{e505f7ce-249f-430f-8ea3-c198dc1264c1}.final
{76e4ae79-4e43-4b3b-b190-78e59640f6c2}.final
{207cddc2-27d4-4c0e-8a3d-0cd359a560c9}.final
{5c0c6f9b-699a-4f87-b6f8-9ab8c3b79aca}.final
{0d1e3bbf-cc40-449a-91dd-129eda7d3dcb}.final
{a5b5081d-4361-4830-9b1c-f5ba8a8662cc}.final
{e76f20a8-9761-47bb-aede-a84acb0d46cc}.final
{1240293c-7fd9-4e10-9a72-ed9f410a0fce}.final
{a5acd6c8-e298-4577-b799-d8a6151d84cf}.final
{46e1c0ea-4c8c-424c-bdf0-82b75fa656d1}.final
{a2f6be48-fbc4-46fc-831f-4218116d3cd2}.final
{94a6d429-4f8e-4e2a-bade-1dce7e39e4d5}.final
{6f615971-645d-4f7e-a38e-ad8b6a0184d6}.final
{d1d39c20-9ea7-4105-baa3-0882196466d7}.final
{8e798ef2-87dc-4897-a08f-d2e83cf8c9de}.final
{b2de57ae-bfd1-4c9e-bf05-11614484d7de}.final
{11e13502-3f62-4faa-ae0a-18cbc7a181df}.final
{e3f1d5d3-403e-4cc4-8540-88bc770416e0}.final
{212e9cc2-43ba-41f0-b8d9-a2981832a1e2}.final
{ec898d7b-2e8c-43bb-b08e-d5e01a4cb7e2}.final
{3934d0fe-ef08-423d-8a2c-470fbd1edc16}.final
{b718a12e-8824-40be-a324-b213603584e6}.final
{eed7ca6e-0374-4951-8e71-b96bd2aa49e9}.final
{d805dbc2-dd0d-48ec-bdc8-e0644ef905ea}.final
{c3ee5f3c-8b3f-4c4f-8437-a18db2a1f5eb}.final
{9e72c7cb-eaa4-42d6-a37b-280bff862aec}.final
{b75faa1f-2500-40da-ac3d-58cf31c726ec}.final
{7393ec57-5041-4cfa-a306-3a72590672ed}.final
{96598426-965c-476e-9029-eadb73f7a7f0}.final
{cb1dd4ce-a2e2-42c0-9ce8-8b2c0dbc44f0}.final
{895cf481-0b3c-4e97-ab12-3866d7e7c5f4}.final
{f80461ad-ec5f-4365-b9ba-93d47d2f6ff6}.final
{0bdccbef-bca7-4fb6-8b5e-c3afa3e534f7}.final
{2fbe8e7f-83fc-4031-b49f-159d8892f4f7}.final
{67cab157-443f-4b7e-b7fc-b07ae1c5e3f7}.final
{7e2b3ada-2ce7-4086-8873-4bfc1febb4f8}.final
{7e91d916-2aa1-4032-ace6-a640a3015eff}.final
{6467284e-4da9-4fd0-969c-230c7970591d}.final
{5839a17b-9cef-4da7-88fe-45ea4413b420}.final
{7767ac62-e113-4057-bf6b-34e0bc3e3925}.final
{7d676a60-113e-45bc-bc2f-1b8a9a45f425}.final
{afe17b17-c41f-4c32-bd42-ed47d59a9b26}.final
{a9b2200d-3b94-478b-8895-da114ef90c27}.final
{33d6117a-da97-4e2c-aa90-29219255a52b}.final
{2282fd46-5506-4bfd-89a7-75db5a09c231}.final
{82e84c91-78b0-4e1b-ad53-09b063e17a37}.final
{d4d5d97d-301d-49d8-b6b0-403676908039}.final
{8958494e-ae21-471b-93f4-1b5e5d86823b}.final
{990b46bb-04ce-4049-a228-38a4f04d7c3d}.final
{07f0bc37-7afd-4843-96e4-cbe9d7835f3e}.final
{65073a62-38dd-4cda-b813-193e035fdf3e}.final
{3919022f-8974-49ff-9d73-d633e32d5041}.final
{e3cf89d7-ba9b-4c5d-8d34-f151b15ec541}.final
{1a4acc51-22c7-423c-b6d4-344b249a0547}.final
{212cbc41-63e3-4ab0-acca-0a973f2fcd07}.final
{edd44f31-aa4a-42b2-8e6f-ddd1cbe41851}.final
{22cc0a23-3a49-4151-aea6-fbf37f278152}.final
{e1936539-582a-4ee5-af65-3d550336fa53}.final
{8cb9635c-f067-416d-99d0-5b25e0b43655}.final
{f428aaa7-2e1f-4c69-bd26-e96ad5236456}.final
{7de8bb99-05a5-4fec-b9ef-c2e71633e55a}.final
{d006944a-2d73-4e6f-bf11-0eb1259fba5a}.final
{55c31c3c-dce3-4d41-ab29-ef04f167dd5b}.final
{f4a1623a-129b-4074-9f63-b73d58f3865c}.final
{691448da-b4f4-4aaf-9ae7-49cd8429e760}.final
{37ac3a17-0a82-426c-9cc1-eb38b13a1563}.final
1885167768yCt7-%iCt7-%rfe0s6p6o.sqlite
3211250388sbwdpsunsohintoatciif.sqlite-wal
3870112724rsegmnoittet-es.sqlite
appxblockmap.xml
appxmanifest.xml
Launcher.dll
Launcher.exe
TrustLauncher.exe
ExpLauncher_v5.3.7.7z
TrustLauncher.rar
memory/1216-5105-0x0000000002440000-0x0000000002840000-memory.dmp
memory/1216-5101-0x0000000002440000-0x0000000002840000-memory.dmp
memory/1216-5103-0x0000000075E80000-0x0000000076095000-memory.dmp
memory/1216-5096-0x0000000000510000-0x0000000000519000-memory.dmp
memory/1216-5099-0x0000000002440000-0x0000000002840000-memory.dmp
memory/1216-5098-0x0000000002440000-0x0000000002840000-memory.dmp
memory/1216-5100-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/1540-8895-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8890-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8891-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8884-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8885-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8893-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8886-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8896-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8894-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/1540-8892-0x000001BC359C0000-0x000001BC359C1000-memory.dmp
memory/2692-8768-0x00007FF720F40000-0x00007FF72197E000-memory.dmp
memory/2692-8766-0x00007FF720F40000-0x00007FF72197E000-memory.dmp
memory/3024-5078-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/3024-5087-0x0000000002BC0000-0x0000000004BC0000-memory.dmp
memory/3024-5077-0x0000000000730000-0x0000000000792000-memory.dmp
memory/3024-5106-0x0000000002BC0000-0x0000000004BC0000-memory.dmp
memory/3024-5085-0x0000000074670000-0x0000000074E20000-memory.dmp
memory/4232-5095-0x0000000075E80000-0x0000000076095000-memory.dmp
memory/4232-5086-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4232-5088-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4232-5081-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4232-5089-0x0000000003A30000-0x0000000003E30000-memory.dmp
memory/4232-5091-0x0000000003A30000-0x0000000003E30000-memory.dmp
memory/4232-5090-0x0000000003A30000-0x0000000003E30000-memory.dmp
memory/4232-5092-0x00007FF8DBE30000-0x00007FF8DC025000-memory.dmp
memory/4232-5094-0x0000000003A30000-0x0000000003E30000-memory.dmp
memory/4232-5104-0x0000000003A30000-0x0000000003E30000-memory.dmp
memory/5132-8767-0x0000000000380000-0x00000000003C9000-memory.dmp
memory/5132-8774-0x0000000000770000-0x00000000007A2000-memory.dmp
memory/5132-8775-0x0000000000770000-0x00000000007A2000-memory.dmp
memory/5132-8776-0x0000000000770000-0x00000000007A2000-memory.dmp
memory/5132-8773-0x0000000000770000-0x00000000007A2000-memory.dmp
memory/5132-8817-0x0000000000380000-0x00000000003C9000-memory.dmp
memory/5132-8772-0x0000000000770000-0x00000000007A2000-memory.dmp
memory/5132-8771-0x0000000000380000-0x00000000003C9000-memory.dmp
memory/5132-8770-0x0000000000380000-0x00000000003C9000-memory.dmp
memory/7036-8464-0x00000000009D0000-0x0000000000A02000-memory.dmp
memory/7036-8463-0x00000000009D0000-0x0000000000A02000-memory.dmp
memory/7036-8462-0x00000000009D0000-0x0000000000A02000-memory.dmp
memory/7036-8461-0x00000000009D0000-0x0000000000A02000-memory.dmp
memory/7036-8460-0x00000000009D0000-0x0000000000A02000-memory.dmp
memory/7036-8459-0x00000000009D0000-0x0000000000A02000-memory.dmp
memory/7036-8458-0x00000000006B0000-0x00000000006F9000-memory.dmp
memory/7036-8457-0x00000000006B0000-0x00000000006F9000-memory.dmp
memory/7036-8454-0x00000000006B0000-0x00000000006F9000-memory.dmp
memory/7508-8455-0x00007FF720F40000-0x00007FF72197E000-memory.dmp
memory/7508-8436-0x00007FF720F40000-0x00007FF72197E000-memory.dmp