Analysis
- user interaction
yes - max time kernel
331s - max time network
332s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
17/04/2026, 16:35
General
- Target http://google.com
- Sample260417-t33l3sf14s
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\ransomware_notes-main.zip.crdownload
-
avaddon
Ransom Note
- PK �����\u�\������������� �ransomware_notes-main/UT��(�iPK �����\u�\������������� �ransomware_notes-main/0apt/UT��(�iPK ����\u�\o W�u�����)� �ransomware_notes-main/0apt/README0apt.txtUT��(�ieUQo�6~ׯ��aK�X��l-��Aq�Ĉk�� �@K'� E�$eU�����&�^ ���}��w �$��:��jv�m I�(z�� ��<� 7�y�� �d�-g��u���]��;TʜEѼ��t ,�EQJ]��I :'j<��[h��,�i� ~u���ƾ�N8�"j�R|��"�KJ���������[����5]G��]��]�^g����� )l���[e$��;�ъ�T�Kt �X�E�� �mW��b ��C�G�� b4[ᐾ�V/]��B�2� ����AÅ� &�% �K����X��8�N��a2���6�d����i �Dj!�6�x- � �TRrNo:|�Z� �"�&�SXd�=<���|y�D�X�������2��<NFW�D��P#�1 �k�� �7Њ ����/ �� �!p�����J:�(u�%r �*S�y�z��u�O�u�D�K� "ut�z�|�Y�V����>̘��`��h���i�%}Y3� C�m��&I�֍V�B{����n:G'�-Hm�:-�uD� �7FAeMC-���+��6]����c������|>��d�e����2?M~�Qh�� G��a X>�J����("��x)L˂5�ȳ�Q�Fj���@z)I&��"�B���_�f�%[����.8��i�V�5�KhJ�'�d-F��Bj������6B 6�P��#Z�~�uX��$��h��k��2Og#���!g��w�6���i��2 ������!�<Θ��@��A¡#e�`�][���&���u��y��1��Z��X���Ϲ�UK�& $�b���Qk,eO5礔���� �S_��e���Nj˗�+�o��XMk�*3� -���h�\����&n�i ���]]Đ�vG~�D�!���&���G��L�6��<��d^�� ��� H�μ�$���9ȭ"�m��� �a����3 ��ӈ����I��Ӳ�g�/��>{&S�қ�|�%aO����@4 ���3CV�Y�H�T dS2�h �'�}�+�Cg_#�����go����PGl�-�FhҞb�K���N�H� �F�Ԣ�7/Fض���B�� ,��x�r�" �����/'��!�#Q��-��}�&_�� =�M�4>_���?����`�4X�,Q � �L�_2�Q40�D�PK �����\u�\������������� �ransomware_notes-main/3am/UT��(�iPK ����\u�\���@��Z ��+� �ransomware_notes-main/3am/RECOVER-FILES.txtUT��(�i�U�n�6��+&1�z �>���Cўz� ��聖(�k�Ԓ����w��d9�� aX�4���7C�MKp��o�e��b��% ������Q�X�B��9�F"�N�01 ��]5�1B�hq�f��'��h֖��y�k���m�R�Ɯ<e˹<}]�G�7rg��3����X�)�s����+!V���> ��?��Z�~���p���� � o�<U8M�����,t�La�� "�G���Y# �f|Chc�5c�#<}G`���@ ��F���G(Qs'�f�ڰ��\e @PΊǵyA2E���� Β\�|I�`��v����m�+�����[����C���̚��H�j^�͝�k>]��t�b�ƃc��&����P:0����+��9 �������_����X� ��iC��M��r�,�� �����Ӕ��:"�V�/��f�}�f����{pΓ^*c���G��=|�+��Q�jh�u�C�A�S +�ߍ��u jmT��U T^�.� �-}�FUq�������7��ޝ�:zg�0�V�<mey�����m�V��"���B��We�X ��|�:] �"��*vނ|A߸Vy��To�&:p^ﴕB�Q��81��)ʫ ʬd���a���L '�s���Q!�dE�XD{�n�NM ��u!��6:�D�8�!�o�\�.��M�l�R�K��z �̝��� ����2f��P�6� PN��DdMN8d� ���:m�3��� R�ZjO2�'ލ�0 �e���8P{���ƕh�U����-�Җ U��PD ��Sp䰶���Ԉ��+8� �h0�C+}�x� wK���a�L���:tʖ���+��`�P8Z�zU�`���TKU��p���G2 v��al�w}��킶*ɾ�zO�M)��5vh� :$���H��)r��"��a�li�����4Ԡ�ԕ������4XX-8�Ơ���6 �l3g�O�9�(�觤.��)���'���Q���p"k��Q4X������?o�;埋}���f�H]6 믏���O�ɘ��ҷ��C��_�O!"�w�� ���:}���ب�8�ʒ� T�\��n�-�PK �����\u�\������������ � �ransomware_notes-main/8base/UT��(�iPK ����\u�\��߃���~'��*� �ransomware_notes-main/8base/8base_note.htaUT��(�i�Z�o�J���+��P;#m�U:�I��t4�6�0`B��Q`��r\e�Y����ʐ�Gw���J+mZ�W�y��9����Ptٜ�T�3}4�����N���Y].�S)�J�\V����c,�*��,+e�I�esR�X4ʔ%��J.sOo���5 ?�����'x1���Y ���i�G.��y�֬� �0��GN�� ������~ۯ�L�J�@T���a�!Mև�NC��-vJ����bh�n_Ն�) e��i���ZN8J��="aA�ď �h�ZK����o2"TH^ ����f� jV����j�����@㨔�.��9�V`������NJ���B�#�X `��dax���������� >!� �B�f�E����~VD�)N�ş/�B+Y����ׁۣ ��B�+Tk�Z�-g�LH�W� ���=���o�� ��K.�ɉ��8��+?��8�?Ŗ N�l�o%?�����1���z}|��HJE���#�c�u�h ��5�uy!�#'��ܼ�V�/�,�N�|# w����d��k �trR���&����Vy-�Y<?Z���k��9���E����Q��V����'�� : ��6>à��,>`'��b� A��qע .�^�u�K� �~& �הN�RFއ��ޜ�G��S�#����υ+B"�� p��e�A� Eћ����oȽ����!դZ����ip|p ���w�'��3��h~_�j�}���j�ȅ҂��}�Ƅ��'�����"��^���`P)�f��}F��g ℟]z�N����%�� n�;��=+���s4/jcy_ ����*�����N t�prr���&ηS�b֕ By*���Oۢ���ſo듬r�] ����S�KxR�Ƕ$Kc� ����x�u���ݑ\�zm�,�WF�v���y� $i�aA��Ϯ {��S��[�vf<�px۟T�R��G�~���uT������HԔƲ��q����p2^��,�fF'�"~H�u|?!���hN��tb�;� �$|��s5\/n�j�g��P��*k�X��d�=u���C�0�2��N�t �LQ�;��m= *��C��f߽���t䞝�ζ��ca��[.�� N�j�p�PѪ�mԯLK[�m=� u�E�H���3��;��/=�2s�Vce��!� �Z���m~Mz# ����?�6KK��mF�m�㛊��͡��8�� 9U;˧3����Џ:-��ݫ�&�<��V9� �=��6�* U{57���1.��C;A4[����ŃӘ�m���1�ԣۉm^�T��|Pi��e8���� K�$�)V#�����C�լQJh{�w��c��u�(^UfgY�n�I���O���"�f=�x\�R��BI����0 �w�8��e4 ��ǎn4X3�6k)� %[�ij%Ӻ�]H��;�a=�Ift��W�[+o�ګ5�,۶� R�� �ͬ��kH�E��6i�m{6���u{�e�1�ֽF� w�̔�lW��f�~l |�|Y�<� ϫ�5�%�Nw�� ��f33 ��l�X���-�?* }��Y���ѯ}{͂�p0�q�!Uk5w���jm����,*w5�%����y��J���ﯞ��$���SHs����fbF��Uzy�f,�3�P�rV��w�< �����߭:�>���E�§m-d�m{�5�q�����#���V�� �ێBd�E��q���l�1i�R�<n��Iz�A��>>e�KIN�aFk�gc��w���� �����p�>y��iխJ����i����=e[�����q��+�+Mz H�me��̕�V^�x1n�w�������"��'�q"�+}]����,ϛI=~d�qi?�Sl<���~9"#ŪH�r��)�q�%=�^��R�5In]*��v���ݲ�����6��QŐ=Ng�v�ެ��epy�P�t6;ٻ$����W��56g��*���aҙ�&���$��a�8�T �R>P�f ��7��^Qs}5h�+�r��2��u/m�ql��L���cΙ1�k��1ZK���ՍJ6�+�A0�Vd��$�4($t�Jk(�P2�����)�5�� ��ol%h`E��!� �e�V� �7No�3�i���wm�r�" s���<��S Կ ��3���bW�vrs������ OP�YF����3�`�K �IϢȆ�9И�>��N�sNF�;V�x�B� ���x��0 �}PG��B�벐��3ڛ �(CV�"9W L�M�Xr [0�G�rJ�'Hy#��th1�k�xA@"+�Q@(��� -���R�4,��o����ެ��\[�K���a���O5k�̝0p��W8r�(��0�lB��t��Ov#�^8!q�8̿R�-�����B��l��]M �eb�|Џ" �\c ��R�ˢ7��L���� ��C�(ON�H)�T>B�L��ˢ�;�����SQG����6�"�@�9�d�?�����(��C3<7� ٢Z�"U�LN���U�C�S��3��{ YP��_ *㜇+IPH6��`� IaZV���UE�:~�A��Hw�H e� �0�C�L}��(�~"w M�� �E�(�#ibΑ�w̙4Q�Ho&BdȢ;de>����,X����P�l���[��~���A�H?0�� ���MME� �>A�0A ����F�6 B�g)p�����Z��>��� ��F�&)X����n *p��O0��� T%YS] �)F��I��JH}����CzG(hh�T�����A���R4�{�@=i4: ���`�}�#�(��L��1�Ϗ ��g��b|���a� ��9<;��� /@�Y<���� 8G v�Dxc�Q D��~���,��"��)� c��!���A�/*��2�K- Ih̷�+R� 6(Ti�+Ғ�m$����A����K��]p��H��ڱ7� �EP�����C�0���gm@��W� B)��� �x)��� /$z-9�� ��^��Ad���uxQ��� �T��b�T:@��s��P@�/����u�T�a~= k�$�R*��*`�)�� �2������J��בu�P��= * א8)o��� %��ȋ$�Q�-�qG��� I� z'�;��� c��}����Ȋ �Xt�����j�ц���r �Q�,��l��3��ǧ��x��o� �������~�|^t~[�� �����&�h��{�W ��Ш#SG����a��E�'�ΐ1�� ��_d�r ~>����vt\t�~�x>��#���l����{�$�8�@w�Xa~�)�Q ���"h �dFHp\���n���� �H!��9�V�Uy��S�l�� ���H\Жw� �=|n�=m�:Tu������rcq �H |8 q<[ ��� �E�����U�� FB�B��BR����(����+� 0N���V5(�K�x�~U���g\X9^�w�;x��\��?(�����r��F�ah�TY3��^��P�����]ыqjR�mjH ^p�S9d{�X�e@�Z1}���}���d���?�8� �"�y}S �WP�y�@DS^Qh ��ZL�$YZ��;*�Gu���� [��6��x �����!��~1��nA��R!�>��MS^#ym��faizR�F;u���:*֡` ���s�����W ���� ��[�%��xP ��<`���윑��|`q�K����2��[�A���� Ȓ������gjD�s�Z��<�~.���{����9�� �a��u�j6�(� , ��ـ��ųƳ!����,��e� 306g��[�p�x����F�L~ �0c�k0��a���� ̡� >y7UT��� �L1�Z~p���^E�����u�����x3U\I��P�ȵD/�O�������(r+p�8�{����G�"�P����Wg��f�����ڪI��y�Ѫ �� �� 68���m�$Y�1e}hJ� �� 齽�Pc���%��B����~�̉�_WA����w�\G�U�� W��&�z�p��ˀ �<��,�7b_�hZ���K�O)o,����*ފ�����W�G��� �,5�)� T�c�� [�?.������!^l�GCq)���ҋ��H��*G\?�}�f�@��7�����Q%�RzD�iC^( � ���퇫^����T�ݳ G���D�N�?��a \�����O���5s� ��aKr)���v�nL�k�����?����X�����=�۳����Q����Kܰ�7��h�hAujq�I����v俣8|��'6��a� �Xr$���m+_T�Y �l8C��y�p?� 1x[������� ���7PK ����\u�\>M= �����*� �ransomware_notes-main/8base/8base_note.txtUT��(�i�X]o�6���ޭbM��E���n#̵�ZJ�\�ms�H��캿~��$�ɺ�����E>���G#� ��_�B(w���{ъ�uŸ��I�fn#-+��Xw¤�5W��{��=�z�0%�N�{&��p�L�� [m�eK!KuQ]H+���wS#�Ly�2�8�au.���5+� � *5�҉���د=��%��c\eL�|OQ@,(6)W,� Aq)�S�*� ������� Vp����+ �ڳ\[ �t�V�O����{3%�b�t�}��q�|����[QJ���"�����pi�.�p�� ��?�n����-�F�j��_�NK��6{��%"k� v��J����bo⭐덣S^6������%�c�a6��n��G�,N�U2����e4���W��.x�ƣ(�e ��8f�)� �����B��>Ab�=e\V�-]Q��"|~�TWy�F����ا>����Rz��L�¦��d��X�,J��\�"`�g��&&���h1��Er��ه�6\����}Be��-��I���Y�r;���P�<��-�?� �=x�zD@;0�|,���3_�$�����l1����?����R��m' c���g��� �e� ��K]9{'l��LS,�G��40�] �z����>� ���埛�9���N6�}> �a�]f |��(��7��St��얍�U_̮���n9�K+�d���^�1�V # A��- `����2��a�J�G?��o(#�GH_oH�b ��>�Vd�q��)] ��� d����7� �K#�ș���a���1 2�[�r����� f����� ���&u���5��8��3TH광�M���N�ZO��Jԕ�M6| �s��=*n�r�3ă�M�慮�����d�=��Z�6�;����T�UIa����}/ @�g(�P.(��>�s�0]l�Y��9�I�����9�܄��1`/ ��uN��q2'��/��fb��CN��"M�� �� i m ��� ������.nmW������������U*��e�c��h,�j�eJN�4�<ybq�iEU+\��4���T#~��T8EY�*��*C��n'a����UIy��U}�J����� (�g,��bM�8a�� * � ��봫]�Ʒ-��.�����Q�ݐz�T�;��A��JQ�Cu��(D���y��E���G����}��{us� $ �o!�k#�W��LЄ$�;O]�˯�3 N�����-�J�� ���m��Ԃ^ �w����E}N@�s%n�ǮnD^����O��a!�F�k���M-Yp�:ɻ���W��%7�%�爗 q��h*P���g�Q�td!�F �� �~y�l>���c��*���q�wʜ��)���l�4�tmE�y8ڣy BV˶- ��XOH��Ԩő�)Ɗ��FQ�셑Ď���e*��B�[�[!�`R�Di��J~="�cVx���C��<��Qy=.�o�⮣&���9�אt���).fmE�F�O�^ ]L?�qYek�|�����҈d�ߕλ������c�J�Q4�xh�F�N*4#�tX�%S� Dn�+�q!x�!&�kj�-�!{C�����c! $���(�Ok�3��ـ=�j�� Qn�3�p7�TN(<����jQ!!? ��:�E%�CV�K��a �6�F���<�s��9��{5n��d ����[�����Gۯ$����e�b_�ͱ ��ZY���'t�7���y.%5�����a�G ���4 �(Zzs@ 52�װT�g�Y�A��li�i?�@��T���QS��- ;�4 �^8 C踻V"�?+R�%z�V����O[)v�x�^�g�ap���.��c_%5,�L�ge �� F��y>�S���v��j � �n�X��gI��M ����]�o� �<�uL%���ᩝ�H���c{�����Jc\�)da]F�(���.P���-���
Signatures
- Family: Avaddon
Ransomware-as-a-service first released in June 2020 and currently expanding its userbase among criminal actors.
- Executes dropped EXE 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in Program Files directory 26 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 17 IoCs
- Modifies registry class 11 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 58 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7ff95890c188,0x7ff95890c194,0x7ff95890c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,12834551408727424720,16538979454676890025,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17007868940794383949,2514090004207141123,262144 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2228,i,6249292897441297555,1976091972039347025,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,8671962273982243120,17067063777017310632,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,10145192380826544778,10918614508291200838,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,9634593813034756316,8458910171235745605,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,13661730144730487021,15986666110553236813,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,16688670123497373059,584679479767111253,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,2049753609524937329,2211359864259170852,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5412,i,6541901427339294403,13650220320296372880,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,4608056876996622079,10797713718032512697,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,11753777296120537873,4038190836876130738,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,8647626834892852817,10062071589578159203,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,8647626834892852817,10062071589578159203,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,11132139908181653218,1891344464617948821,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9836405115498818735,5659748246816166835,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10304129322078216678,17763741462923264015,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,2579793220789874889,10383932276227781614,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1567578578511717554,9868203162091519946,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,16788666428802981074,4962476103435293338,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,7319441213630856437,3615475648539559790,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,2337049247717341096,14382616029436279274,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5392,i,6611974788438413173,290584759102070589,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,13759211298965520969,12325622159533220700,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6416,i,309279994940392412,9978917907480475002,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,10138059469414577729,7196581052922767475,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6564,i,17263919001930952169,2792005479983537014,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,12820032651123983810,5782398410335115211,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,16423285951798155324,13920745013612753111,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,11444878239264280901,6007397917415942868,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,6539580904689594615,2808668902027496701,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=2548,i,12806046721259294297,1975013701087017562,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6540,i,12884085883864506308,179333311871219094,262144 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,7365923722375790423,579513555255762699,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5972,i,7457757527966746087,13778943230205682521,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3316,i,6309120650896374868,17982909407565460533,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7292,i,7615702442396328814,6313700119901994317,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7344,i,4913438443661131095,15222503950173889384,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7576,i,10479205482645085928,12035656019181436285,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7716,i,5730490929088541845,18061815576730228359,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,17299188470661951973,17642937297653609562,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8104,i,8033247337150392749,12977455965492552478,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8040,i,2737803304146919780,821690087132221,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7924 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7960,i,10900936042746062337,3733237965549695965,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=8144 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7580,i,13991793013210815883,18180152629046935740,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7776,i,15138012410045459060,7784960338785372558,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8100,i,519873823532756835,720863325065137077,2097152 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,226493077111407956,2670229724601295757,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,10343278450530847577,3527186915691924173,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8344,i,15978254974430870726,6284094138109181358,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=8288 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,387442072580443699,6653555743734718741,524288 --field-trial-handle=2280,i,10512552045851839987,13812804245437431166,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_PowerPoint.zip\[email protected]"C:\Users\Admin\AppData\Local\Temp\Temp1_PowerPoint.zip\[email protected]"1⤵
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\sys3.exeC:\Users\Admin\AppData\Local\Temp\\sys3.exe2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa396f855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
blocklist
protocols.json
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_000097
f_000098
f_000099
f_00009a
f_00009b
f_00009c
f_00009d
f_00009e
f_00009f
f_0000a0
f_0000a1
f_0000a2
f_0000a3
f_0000a4
f_0000a8
f_0000a9
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000bf
f_0000c0
f_0000c1
f_0000c4
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe588306.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5abd56.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5a6c09.TMP
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe5ac0c1.TMP
a98f4ccb4eedee62_0
the-real-index
sync_diagnostic.log
CURRENT
MANIFEST-000001
OperationConfig
OperationConfig~RFe590555.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe591042.TMP
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
e5ae21b0-42f1-4be5-a881-3bf925696cfc.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
687e72e8-c53a-4e38-a231-3f26ef929817.tmp
a45e958c-a21f-426a-ab45-b4957f2db4fc.tmp
f8d34f3f-2332-4c9b-8f87-f5514b66f43c.tmp
content_new.js
sys3.exe
systm.txt
ransomware_notes-main.zip.crdownload
memory/5692-3208-0x000000002AA00000-0x000000002AA24000-memory.dmp
memory/5692-3214-0x000000002AA00000-0x000000002AA24000-memory.dmp