Analysis
- user interaction
yes - max time kernel
1049s - max time network
1057s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
22/04/2026, 18:06
General
- Target http://Instagram.com
- Sample260422-wpqfpsdv3p
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Loads dropped DLL 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 53 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Instagram.com1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ff83573c188,0x7ff83573c194,0x7ff83573c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,1055929925071780996,8256420451866701898,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,11680687943385438605,12952155577246218780,262144 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,6776605655604352848,12980839952505137933,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3020 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,2077317341915318608,9297335737444302230,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3520,i,10097624151793245137,17657432914289113268,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4120,i,13242122457786762758,8898409246138085506,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4164,i,10666452682381041475,7845833086972552270,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4284,i,1538941212005658500,2348361905954680444,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4328,i,2996111849694397224,8408444201653388342,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,9047303384509849391,5496718152313302468,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,14188295259478761896,12932986209468428648,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5504,i,7222608144350925337,1162226578485095055,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,5821805628435013209,12766809090397793087,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,5821805628435013209,12766809090397793087,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,11723036463472557154,5141805374283834537,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,3682007300044383948,18226665137549215488,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10743943110514145595,14661645050013508457,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,6250222295459071063,7767851594391489015,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,1915350453174219475,12899892761855969067,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,5400626932969322484,11601039752544766495,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,6474112519911324689,15056226363351286087,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,7926973249019921137,2137231419793419617,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4304,i,4809652788895858335,10163279253124960830,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4408,i,11516892510329956010,8975615802098550949,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=4504,i,6416201445740339484,2482291298108448982,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,11274491959595713269,4439591549256420697,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,7369076662384520305,6325053344242033831,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,15906170937112075540,12653054357457991054,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4412,i,8747659567640757461,11272615152101578917,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=3492,i,3746051137790159499,10607957591039659557,2097152 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,10766321415355261463,8739708970644870117,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,1014981298718736490,7935164183394582800,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,12501855496676079619,2032482568226586506,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,17118697825932516807,9665664169533168528,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7032,i,2873303813131181848,8080063710327116982,262144 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13858774973299212289,17741338457711201237,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,1468267685486013764,5939552820103159773,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,11819143951683740494,7411110168054047628,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,14332195397041031325,16128461082180586502,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,2437946480342344633,5283063771407469700,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,498307454034880448,6354749391536112807,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,9232804784358588323,14687157743255837166,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,10956540733855695970,3391122304620365784,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,10959621410100623207,17928954384440010429,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,17888444909275737847,6078978812019791021,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,5015798651730471506,2465655649188379295,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,1460177994801834316,1117011021299267139,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,2060309610069911603,8038501006301482297,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2808,i,10536893203962831489,4537997941658337897,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,17618770741091326418,16344686869964887484,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17079231600262736298,328071274604931865,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12847182265539897971,1751564303979130659,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,17853529845097831206,9877012480814640051,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,2555324008659633785,7731799208132951090,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,6359776074220410194,3646214792683776018,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,8627067883185857587,11103372801641682504,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1163189498128421575,8466455056087149421,524288 --field-trial-handle=2868,i,7157354825740881327,8970368994619094681,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
a8a29333-3a10-4c2a-b453-991be926b4a8.tmp
protocols.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
crl-set
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_00008d
f_00009d
f_0000ba
f_0000ca
f_0000e3
f_0000e4
f_0000e5
f_0000e8
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe596b62.TMP
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe590dc2.TMP
the-real-index
the-real-index~RFe590db2.TMP
index.txt
index.txt
index.txt~RFe58bf15.TMP
the-real-index
the-real-index~RFe5cf6fa.TMP
index.txt
67a473248953641b_0
ba23d8ecda68de77_0
the-real-index
the-real-index~RFe5910bf.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
d53981a0-2bd3-4d7e-9cae-4a06073c784b.tmp
domain_actions.dll
data.txt
OperationConfig
OperationConfig~RFe59450e.TMP
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58f45e.TMP
safety_tips.pb
typosquatting_list.pb
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Other
Social
keys.json
typosquatting_list.pb
well_known_domains.dll
nav_config.json
ranked_dicts
9f9b7b54-ecbc-4ee0-89a5-6e2799335305.tmp
a38f1b89-9d2f-4ddf-b700-c85103ad1c18.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
e0995d64-df1a-4e53-a855-4521573ff79f.tmp
fe43afce-1e12-4899-87e5-0c67b815aa26.tmp
content_new.js
7cec2733-b7b3-43b2-b7b8-a53aea74273a.tmp
default.dic
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
Staging
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
memory/1992-625-0x00000230F68D0000-0x00000230F6A6A000-memory.dmp
memory/1996-1945-0x0000027E18550000-0x0000027E186EA000-memory.dmp
memory/1996-1936-0x0000027E18550000-0x0000027E186EA000-memory.dmp
memory/1996-2118-0x0000027E18550000-0x0000027E186EA000-memory.dmp
memory/2320-1937-0x0000000002510000-0x00000000026AA000-memory.dmp
memory/2320-2001-0x0000000002510000-0x00000000026AA000-memory.dmp
memory/4992-1939-0x00000233A3E60000-0x00000233A3FFA000-memory.dmp
memory/4992-1991-0x00000233A3E60000-0x00000233A3FFA000-memory.dmp
memory/5012-1776-0x000001A4FF2F0000-0x000001A4FF310000-memory.dmp
memory/5012-1938-0x0000019BE3800000-0x0000019BE399A000-memory.dmp
memory/5012-1775-0x000001A4FF5C0000-0x000001A4FF6C0000-memory.dmp
memory/5012-1753-0x000001A3FE700000-0x000001A3FE720000-memory.dmp
memory/5012-1752-0x000001A4FE9A0000-0x000001A4FE9C0000-memory.dmp
memory/5012-1690-0x000001A3EAAE0000-0x000001A3EABE0000-memory.dmp