Analysis
- user interaction
yes - max time kernel
417s - max time network
424s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
28/04/2026, 04:41
General
- Target https://getambrion.vercel.app/download/validate?token=b9b4ccfc-fdb3-410f-a2a4-e806e1dc5337&type=external
- Sample260428-fa9m2adv8t
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 7 IoCs
- Loads dropped DLL 39 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 21 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 57 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 3 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 58 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getambrion.vercel.app/download/validate?token=b9b4ccfc-fdb3-410f-a2a4-e806e1dc5337&type=external1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ff8ba08c188,0x7ff8ba08c194,0x7ff8ba08c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,4867791000014700708,11746339177331548124,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,1627622653791755700,5332847704441903173,262144 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,8466162933678117794,10137635223167181138,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,6510390375142218258,2394432577695963185,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,3861086458966311431,1647332833456542459,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,3715317386651163994,15695745474695620914,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4164,i,3752032504167887264,13852361360620315108,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4216,i,12307057621948788530,8567001830906861758,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=2948,i,11371609327302498694,5729403052083986290,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,9802970271381558967,11414872335559303296,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,73698685503692924,4531329491261384467,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,7285358396072438703,11581760390009127514,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,10216673436865931944,8377607296620685384,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17917782493339981128,507059295288119843,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,3200403621000102816,11294859251880202194,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,17917782493339981128,507059295288119843,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,17679980312242790646,12009324437391442381,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,5348300350796021470,17803332780508281231,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,7589341095416297885,2091865457566388420,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,10281345399719740176,11280236837560025432,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14132297545816992197,5268130887680584536,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6784,i,5024634178150400196,239431417894932243,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6416,i,2145466237096802584,1329489948945186567,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6968,i,17754713999347097243,3011088641156163161,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6964,i,17669290863223721650,3938576773582438912,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7180,i,15819275501370460629,4315890294114188175,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,14077899303506853667,14523230240883225815,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4280,i,7501234127569659206,5407462480827149521,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=1600,i,5954199011478998445,15155432576111685227,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7632,i,6906172287069378612,9301776075453627278,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7688 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6780,i,4370241821877877554,17014424509513700407,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,5142139410907506745,3485496426182099729,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,779244364604525963,16097973644928162342,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7636 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,12749864445598635966,1624790584193449907,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7580 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7024,i,11641405942389020243,4304713146535707612,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7528,i,16081788097290390712,2169323705543594781,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,17171864675001505700,16486991709122760231,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=5384,i,2471184672758430265,201114134239031839,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7552,i,3845326165241082065,3943486645141701854,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8168,i,519568722624900212,6482364151240406678,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6204,i,55321975263100879,3650909140207427939,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=3284,i,9287054526084043367,16415269953868770969,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7948,i,11382675044217927282,6937793291230885223,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7960 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=7936,i,18004141761787655852,17615964059192508980,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8344,i,8970068004389475897,9930705561081000746,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7572,i,14458151946521065810,8387864253362215083,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6408,i,16883025457647875670,3256268817433529266,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8680,i,8883473721360807819,16422803703803015286,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8668 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=8824,i,3693600166996336804,6286478710908408634,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8360,i,138535369325080342,2114878980768612848,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8440 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8272,i,5977912037978945185,14569980709930656738,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8372,i,15146358357142897751,15334962085034089606,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8836 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=7856,i,8614148710978058925,3280398894668993043,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8360,i,6491271587465112344,5326139643901374556,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7696,i,12229238085809593120,3478356294089301063,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8336 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8720,i,8774648015214888141,17132465425001197182,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7988,i,9037416344064058088,2531781411477551727,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=8792,i,5988280309587481341,1621041300702458086,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=7820,i,18249588483987306407,14329096802014065679,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8384,i,845420105185246164,6584742283290941328,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5388,i,365461156506157540,1650598419196655521,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8568,i,16718655786510139693,6184767733109160381,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,7113267491333978529,9702200259445460685,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8852 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7852,i,10353889753064320577,1701827944030163005,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8980,i,18323294708737859639,976846668501197647,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9000,i,8876526941482018111,17413748235002507488,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=1956,i,15686233975947103405,4379939422030083203,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,7364340317409734436,13323323844794757733,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8516,i,4384295842017802552,16084390284663562913,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8988,i,3709766748449514993,15851060557369614681,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8480 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6992,i,4496081225313695148,15298653007620194064,262144 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,17249348489422959019,11938250113390301151,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8920,i,4943988048727797947,10557334787708253053,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,4372673847489400140,4238988805769876554,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,3703756188579654566,10152141989637476080,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7924,i,3105948337295603683,12013215398205744978,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9116,i,10434888752128855023,1269929335887818268,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=6368,i,16345712712603577659,9182300585924520268,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --always-read-main-dll --metrics-shmem-handle=5264,i,16137534255345606816,9585407531643270604,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=3556,i,3194886184262595492,11289577819634581867,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8496 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --always-read-main-dll --metrics-shmem-handle=3472,i,17287783904593444094,13946568227584250282,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --always-read-main-dll --metrics-shmem-handle=8468,i,5410666975751134687,1618699158304119942,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --always-read-main-dll --metrics-shmem-handle=8988,i,11265511803633009877,4168710764910738556,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=1956,i,1219935353072968200,18289621985662573626,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --always-read-main-dll --metrics-shmem-handle=5528,i,15690796523501747595,4236078345513964775,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9268,i,5653103190446429978,11795621943414049813,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9324,i,13049646349280144249,15768572169367619642,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=95 --always-read-main-dll --metrics-shmem-handle=5388,i,9759025884254847341,10664634315757887410,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=9572,i,9809839122321183055,16552100120302122441,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --always-read-main-dll --metrics-shmem-handle=9392,i,7958298800095390627,18195903358702458669,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --always-read-main-dll --metrics-shmem-handle=4156,i,4332313586898843471,8729196973336183592,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=9720,i,3496412244776130360,15602491078253075013,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9904,i,12847144495851987379,11518147406197610043,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9920 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --always-read-main-dll --metrics-shmem-handle=10120,i,782504553083960439,10878555933192153816,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=10116 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10008,i,10360999256569758128,14092926979651739455,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9992 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,3032297171622451527,14905146786984575904,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9484 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9336,i,9345704266454277980,1115660661373475834,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=9452 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\dotnet-sdk-10.0.203-win-x64.exe"C:\Users\Admin\Downloads\dotnet-sdk-10.0.203-win-x64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\TEMP\{49250470-C7AE-4CE0-9084-EA47F283E09D}\.ba\wixstdba.exe"C:\Windows\TEMP\{49250470-C7AE-4CE0-9084-EA47F283E09D}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{72AB306A-1534-43D2-BAC6-14B952B2043B} {904E5A06-4A26-451D-91A2-D2C16EB28C84}3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\TEMP\{49250470-C7AE-4CE0-9084-EA47F283E09D}\.be\dotnet-sdk-10.0.203-win-x64.exe"C:\Windows\TEMP\{49250470-C7AE-4CE0-9084-EA47F283E09D}\.be\dotnet-sdk-10.0.203-win-x64.exe" -q -burn.elevated BurnPipe.{A2B52A56-262E-46C0-B9EF-7E685D762393} {FC970156-95AB-46BB-B95B-E4A5F04BE489} 71443⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\Package Cache\50F358A994E54F4E761056C5D2EEA7C13F990F2141D3E075E081EEC74D5A197D\finalizer.exe"C:\ProgramData\Package Cache\50F358A994E54F4E761056C5D2EEA7C13F990F2141D3E075E081EEC74D5A197D\finalizer.exe" "C:\Users\Admin\AppData\Local\Temp\Microsoft_.NET_SDK_10.0.203_(x64)_20260428054707_000_Finalizer.log" 10.0.203 x64 64⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10008,i,7649310898846659248,10708563103985070022,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=10048 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10808,i,1622963007130601580,18185479783271652554,524288 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=10812 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --always-read-main-dll --metrics-shmem-handle=7804,i,485732985425554612,8060318537165485233,2097152 --field-trial-handle=2264,i,11324771150594351411,1349462081292960846,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\AmbrionExternal\AmbrionExternal\AmbrionExternal\Ambrion.exe"C:\Users\Admin\Downloads\AmbrionExternal\AmbrionExternal\AmbrionExternal\Ambrion.exe"1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\AmbrionExternal\AmbrionExternal\AmbrionExternal\Ambrion.exe"C:\Users\Admin\Downloads\AmbrionExternal\AmbrionExternal\AmbrionExternal\Ambrion.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\AmbrionExternal\AmbrionExternal\AmbrionExternal\Ambrion.exe"C:\Users\Admin\Downloads\AmbrionExternal\AmbrionExternal\AmbrionExternal\Ambrion.exe"3⤵
-
-
C:\Users\Admin\Downloads\dotnet-sdk-10.0.203-win-x64.exe"C:\Users\Admin\Downloads\dotnet-sdk-10.0.203-win-x64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\TEMP\{902ADB41-2EE0-43BA-ADDF-1410860B336B}\.ba\wixstdba.exe"C:\Windows\TEMP\{902ADB41-2EE0-43BA-ADDF-1410860B336B}\.ba\wixstdba.exe" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{2F3E9102-56BE-4C3B-B6D9-9A60273E7443} {FC6BBEE2-12A8-4DC9-B52B-AB3D05B470EF}4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D24ADAE5FC81AEA9D48E7ABF0BFDC6072⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 2406F9418779CDDD5E140346E127F40B2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding ED132AB404425DA62402A36CED6B16872⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding D89A502C25CEA87DA3B9DB741717BD1E2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 6504139B9E951982309B2EB885F48E942⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1B82CAFE3651986C9B913E37468CD7E62⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding F474C0C4182418A7BA0A4EA21CAD5C6F2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1C904ED07629922C2BF6B7898EF9C7CF2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 1E8693F0442FD5E6834E26AB7C4F8F9B2⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding C3F5702D0713FBB7BCE86B75F6A2B8632⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7B3B8BBF32045414C8D1A1F67990E4752⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 172E7997072D48096EBF21FC079007A7 E Global\MSI00002⤵
- Loads dropped DLL
-
C:\Program Files\dotnet\dotnet.exe"C:\Program Files\dotnet\\dotnet.exe" exec "C:\Program Files\dotnet\\sdk\\dotnet.dll" internal-reportinstallsuccess "C:\Users\Admin\Downloads\dotnet-sdk-10.0.203-win-x64.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 34D13EDC79E4A19301F9408D39F4A9D22⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding CB296C1BEDE0B6F48F05221857462E9C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5BE35F37094158B625802730174663A32⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5DBBBAADC40C672F7BC138C6FDF430B72⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 96DFE610BBCC56452E024B9AA2419B032⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 35D6BA20355F9D5CEFBBCD7B1745B45B2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 502A631DC2380C0A1494663C9F0095442⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 58EA2BCCC50855709C0C2D1D0B812A322⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 14FE5B040CCDC793F12F3F45DD2A3CC12⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DDD52398569DF25FB643C93102A8BB0E2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 5D313BA3599BE05F6BEB3D3571605E2A2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding F55DAC313CAD8122ABB58AFC70440D742⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 2FB30EB3709081DBB76C2403EDB358392⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding BCC90D898C0E48D9313DED5976D209DB2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 0622180551EA78A9F15993B17B1F2BD92⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 29C7F4552E93944ECE7C27C333C614412⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
e5d31d4.rbs
e5d31d9.rbs
e5d31e0.rbs
e5d31e5.rbs
e5d31ea.rbs
e5d31ef.rbs
e5d31f4.rbs
e5d31f9.rbs
e5d31fe.rbs
e5d3203.rbs
e5d3208.rbs
e5d320d.rbs
e5d3212.rbs
e5d3217.rbs
e5d321c.rbs
e5d3221.rbs
e5d3226.rbs
e5d322b.rbs
e5d3230.rbs
e5d3235.rbs
e5d323a.rbs
e5d323f.rbs
e5d3244.rbs
e5d3249.rbs
e5d324e.rbs
e5d3253.rbs
e5d3258.rbs
ThirdPartyNotices.txt
dotnet.exe
containerize.runtimeconfig.json
System.Buffers.dll
System.Memory.dll
System.Numerics.Vectors.dll
System.Runtime.CompilerServices.Unsafe.dll
System.Collections.Immutable.dll
System.IO.Pipelines.dll
System.Text.Encodings.Web.dll
System.ValueTuple.dll
Microsoft.Bcl.AsyncInterfaces.dll
System.Threading.Tasks.Extensions.dll
System.IO.Hashing.dll
LICENSE.txt
Microsoft.SourceLink.GitHub.props
Microsoft.SourceLink.GitLab.targets
System.IO.Hashing.dll
Microsoft.SourceLink.GitLab.dll.config
testhost.net47.x86.exe.config
blocklist
protocols.json
crl-set
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
f_00007e
f_000080
f_000081
f_000083
f_000084
f_000085
f_000087
f_000088
f_000089
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000091
f_000094
f_000095
f_000096
f_00009a
f_00009c
f_00009e
f_0000a2
f_0000a4
f_0000b0
f_0000bc
f_0000ea
f_000116
f_000117
06355fd5fbac9e06_0
2be197e6c596f4ae_0
393424cbc571050c_0
5be875eaf124ec75_0
7e1e69bd26f48907_0
87eef255a91fc2f7_0
905fbec38a53248c_0
99744c5c92204344_0
9bbe72de6b060e5e_0
a930db88ab74594c_0
bb0f412d281c15f2_0
d843e6df58aa1bfc_0
eac861d92777f9b6_0
fa5cffeb657b4c33_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe598d81.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
000003.log
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5ce49b.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
623cd082b6202da0_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5886a0.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe58ee14.TMP
index.txt
index.txt~RFe58ee53.TMP
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index
the-real-index~RFe58eb45.TMP
sync_diagnostic.log
CURRENT
MANIFEST-000001
d90e00c9-a1bf-4671-b52d-81ddee57b1f2.tmp
office_endpoints_list.json
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58913f.TMP
keys.json
nav_config.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
0eb4d04b-2d4c-4a8f-a6c3-0d2169b06d67.tmp
91bd88ee-10f9-4500-8db4-b3f5711ac2c7.tmp
935e7e81-b4d3-410d-979e-6ebdf240ddd3.tmp
99c8d32b-cabd-440f-884f-41bdf872bc59.tmp
content_new.js
_6e010c63a2deb0bfd6117f4ad1c15b7f_x64.msi
dotnet_apphost_pack_10.0.7_win_x64.msi
default.dic
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
OperaGXSetup.exe.crdownload
MSI3639.tmp
MSICD3C.tmp
MSID9F8.tmp
e5d31dd.msi
e5d31ec.msi
icon.ico
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
LICENSE
manifest.json
manifest.json
manifest.json
dotnet-sdk-10.0.203-win-x64.exe
memory/572-10234-0x0000000002A80000-0x0000000002B02000-memory.dmp
memory/1860-9854-0x00000000008F0000-0x0000000000972000-memory.dmp
memory/3232-3470-0x0000019FCE900000-0x0000019FCEA00000-memory.dmp
memory/3232-3557-0x000001A0F3EA0000-0x000001A0F3FA0000-memory.dmp
memory/3232-3533-0x0000019FF2650000-0x0000019FF2670000-memory.dmp
memory/3232-3487-0x0000019FCE800000-0x0000019FCE900000-memory.dmp
memory/3232-3534-0x0000019FF2040000-0x0000019FF2060000-memory.dmp
memory/3232-3578-0x0000019FF24F0000-0x0000019FF25F0000-memory.dmp
memory/3232-3558-0x000001A0F32C0000-0x000001A0F32E0000-memory.dmp
memory/3240-10016-0x0000000002FB0000-0x0000000003032000-memory.dmp
memory/3568-10241-0x00000000024F0000-0x0000000002572000-memory.dmp
memory/3616-10036-0x0000000002B30000-0x0000000002BB2000-memory.dmp
memory/3720-10056-0x00000000022B0000-0x0000000002332000-memory.dmp
memory/3896-2865-0x0000018BA2D60000-0x0000018BA2DFE000-memory.dmp
memory/4372-10096-0x0000000002BA0000-0x0000000002C22000-memory.dmp
memory/5556-2864-0x000001A7E4CF0000-0x000001A7E4D8E000-memory.dmp
memory/5688-2821-0x000002BD65630000-0x000002BD656CE000-memory.dmp
memory/6184-9875-0x0000000003000000-0x0000000003082000-memory.dmp
memory/6236-10243-0x00000000005F0000-0x00000000006B6000-memory.dmp
memory/6236-10244-0x0000000002F20000-0x0000000002FA2000-memory.dmp
memory/6360-9896-0x00000000024E0000-0x0000000002562000-memory.dmp
memory/6416-9916-0x0000000002F40000-0x0000000002FC2000-memory.dmp
memory/6420-10130-0x0000000002E70000-0x0000000002EF2000-memory.dmp
memory/6472-10247-0x000001D9BDDB0000-0x000001D9BDDBC000-memory.dmp
memory/6640-9959-0x0000000002950000-0x00000000029D2000-memory.dmp
memory/6656-10166-0x00000000008D0000-0x0000000000952000-memory.dmp
memory/6708-9938-0x0000000002780000-0x0000000002802000-memory.dmp
memory/6756-10288-0x000002707BA80000-0x000002707BB1E000-memory.dmp
memory/6924-9996-0x00000000006F0000-0x0000000000772000-memory.dmp
memory/7028-10200-0x0000000000880000-0x0000000000902000-memory.dmp
memory/7112-10076-0x00000000031E0000-0x0000000003262000-memory.dmp
memory/7144-10246-0x0000000002630000-0x00000000026B2000-memory.dmp
memory/7144-4771-0x0000000002630000-0x00000000026B2000-memory.dmp