Analysis
- user interaction
yes - max time kernel
795s - max time network
791s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
02/05/2026, 18:10
General
- Target file.html
- Size 326KB
- Sample260502-wsjsbshs8j
- SHA256 dcb9f0331f0111fcc21c678413dcb9adc10938d6c959469188b24de356ceafd5
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 23 IoCs
- Loads dropped DLL 17 IoCs
- Reads ssh keys stored on the system 2 TTPs
Tries to access SSH used by SSH programs.
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 15 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 50 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 40 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 39 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x2f0,0x7ff947ebc188,0x7ff947ebc194,0x7ff947ebc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,11058162606083276853,17705336056864049198,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:32⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,2360956662850482365,17991603321154499395,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11952865313941394683,8603625121810979841,262144 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,9762852151037106565,9713058170702467622,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12457075339254616235,6857296262921121565,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4896,i,8166948001658290950,5273130909208141108,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5032,i,17911684517162172795,6301256851147763688,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5300,i,13634539443985064023,9176886078780334764,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5440,i,15715106021738422133,4206835344514592421,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,614303058674979466,618201822125288749,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5724,i,9763178062031764949,7141918454873764715,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6180,i,2497547009652922693,9055749858350758160,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,10480972484933260683,16255394806543502744,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5456,i,6120015690942875889,15717288106917442864,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,3452069916115930960,10651106000596853176,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,3785991241636280330,17696674549753618193,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,16785067478468294350,6616399560171214823,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,16785067478468294350,6616399560171214823,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5308,i,16893514158927588624,89647279237930045,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5240,i,16518187468504045854,3659526391003285846,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,10186099106724816500,15728515613086018471,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,15402740051559323811,1604939353803767658,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,2629041190749299744,10964049793581242504,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,181874682720079083,11573732326582675190,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7120,i,2789559415540884748,10906817867372641794,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,16628848019232879551,3233391281243598811,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,14712951034638807312,10963564481155987901,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,16421608648807215357,13568995287661645173,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,7609357973656014007,4132716381587943337,262144 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,2640707515304071819,16704230552935754844,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,17453470710003896978,4721345672985062938,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,3657312172451523494,2147048187522006573,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3324 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,15904732061071345704,12826505586141075395,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3920,i,11153538921645380628,761314546360769123,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,11173100555004123360,9264698011640826971,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,422637642267165492,9743297861566391904,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,12956883706155933174,7118300304152029403,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8034809453053725367,1753434652485449979,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,2399735177354877254,5672495796823911943,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,6725148223731078721,10873203633801373092,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,2814311290449368970,2571504974004079674,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,14542248950737052293,9920734732740795715,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4944,i,17826367837845066475,8454055027112045645,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=5108,i,11808966229854492395,4561102787671760083,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=5888,i,9182876569425592248,4884036573294599857,2097152 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,12006267667717436703,11605212791541983280,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:82⤵
-
-
C:\Windows\System32\msiexec.exe"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\node-v24.15.0-x64.msi"2⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,15796982739037973468,18053321643101505221,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7436,i,556181501629359965,14336602044359208242,524288 --field-trial-handle=2604,i,764695955330736383,16208549298711894361,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding FED717DA6A676138EA7772E61D1613B4 C2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding 7955FE777DCCEC5D4EC3F5D3AF07F1232⤵
- Loads dropped DLL
-
-
C:\Windows\System32\MsiExec.exeC:\Windows\System32\MsiExec.exe -Embedding EC536A84982CC857577BA20ACF683321 E Global\MSI00002⤵
- Loads dropped DLL
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding D45810565F08E3DE8955ABE01BCBFE962⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"2⤵
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" install2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\node.exe" "C:\Program Files\nodejs\node_modules\npm\bin\npm-cli.js" install --force --cache=C:\Users\Admin\AppData\Local\npm-cache --prefer-offline=false --prefer-online=false --offline=false --no-progress --no-save --no-audit --include=dev --include=peer --include=optional --no-package-lock-only --no-dry-run3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node-gyp rebuild4⤵
-
C:\Program Files\nodejs\node.exenode "C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\bin\node-gyp.js" rebuild5⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""python3" "-c" "import sys; sys.stdout.buffer.write(sys.executable.encode('utf-8'));""6⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c ""python" "-c" "import sys; sys.stdout.buffer.write(sys.executable.encode('utf-8'));""6⤵
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node scripts/build-from-source.js3⤵
-
C:\Program Files\nodejs\node.exenode scripts/build-from-source.js4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node ./script/select-7z-arch.js3⤵
-
C:\Program Files\nodejs\node.exenode ./script/select-7z-arch.js4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node install.js3⤵
-
C:\Program Files\nodejs\node.exenode install.js4⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c node install.js3⤵
-
C:\Program Files\nodejs\node.exenode install.js4⤵
- Executes dropped EXE
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\node.exe" C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\esbuild\bin\esbuild --version5⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\@esbuild\win32-x64\esbuild.exeC:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\@esbuild\win32-x64\esbuild.exe --version6⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c CALL "C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"2⤵
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-prefix.js"3⤵
- Executes dropped EXE
-
-
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\\node.exe" "C:\Program Files\nodejs\\node_modules\npm\bin\npm-cli.js" run start2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c concurrently "vite" "wait-on http://localhost:5173 && electron ."3⤵
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\.bin\\..\concurrently\dist\bin\concurrently.js" "vite" "wait-on http://localhost:5173 && electron ."4⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Windows\system32\cmd.execmd.exe /s /c "vite"5⤵
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\.bin\\..\vite\bin\vite.js"6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Program Files\nodejs\node.exe"C:\Program Files\nodejs\node.exe" -p console.log(JSON.stringify(require('node:process').report.getReport().header));7⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\@esbuild\win32-x64\esbuild.exeC:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\@esbuild\win32-x64\esbuild.exe --service=0.27.3 --ping7⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "net use"7⤵
-
C:\Windows\system32\net.exenet use8⤵
-
-
-
-
-
C:\Windows\system32\cmd.execmd.exe /s /c "wait-on http://localhost:5173 && electron ."5⤵
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\.bin\\..\wait-on\bin\wait-on" http://localhost:51736⤵
- Executes dropped EXE
-
-
C:\Program Files\nodejs\node.exe"node" "C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\.bin\\..\electron\cli.js" .6⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exeC:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe .7⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe"C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\hollywood" --field-trial-handle=1792,i,10721544085678373342,6421541698703705240,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2168 /prefetch:38⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe"C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\hollywood" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,10721544085678373342,6421541698703705240,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1788 /prefetch:28⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe"C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hollywood" --app-path="C:\Users\Admin\Desktop\SynapseV3-Cosmic-main" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --time-ticks-at-unix-epoch=-1777744954886184 --launch-time-ticks=1231096440 --field-trial-handle=1792,i,10721544085678373342,6421541698703705240,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2584 /prefetch:18⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe"C:\Users\Admin\Desktop\SynapseV3-Cosmic-main\node_modules\electron\dist\electron.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\hollywood" --app-path="C:\Users\Admin\Desktop\SynapseV3-Cosmic-main" --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --time-ticks-at-unix-epoch=-1777744954886184 --launch-time-ticks=1233905561 --field-trial-handle=1792,i,10721544085678373342,6421541698703705240,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,NetworkServiceSandbox,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3512 /prefetch:18⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Discovery
Browser Information Discovery
1Peripheral Device Discovery
2Query Registry
5System Information Discovery
5System Location Discovery
1System Language Discovery
1System Network Configuration Discovery
1Internet Connection Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
e615e3d.rbs
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
keys.json
manifest.json
notification_fast.bundle.js.LICENSE.txt
tokenized-card.bundle.js.LICENSE.txt
strings.json
manifest.json
hyph-as.hyb
hyph-hi.hyb
hyph-nb.hyb
manifest.json
manifest.json
manifest.json
manifest.json
edge_checkout_page_validator.js
manifest.json
LICENSE
shared.types.js
LICENSE
package.json
package.json
LICENSE
LICENSE
LICENSE.md
LICENSE.md
LICENSE
Node.js documentation.url
Node.js website.url
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
C8D02B4227BDBA17232BCBB5B61BEFB6
EF7234CDBB1649702229F955C785C39F
77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
C8D02B4227BDBA17232BCBB5B61BEFB6
EF7234CDBB1649702229F955C785C39F
4d02cc9b-88d9-4b63-8683-c7c943062b41.tmp
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
v1FieldTypes.json
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
f_0000af
the-real-index
the-real-index
the-real-index~RFe58c687.TMP
SiteList-Enterprise.json
HubApps
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index~RFe5cae39.TMP
index.txt
sync_diagnostic.log
CURRENT
MANIFEST-000001
domain_actions.dll
data.txt
wallet-checkout-eligible-sites.json
wallet-notification-config.json
wallet-stable.json
wallet-tokenization-config.json
wallet_donation_driver.js
Local State
Local State
Local State
Local State
Local State
Local State
crs.pb
ct_config.pb
kp_pinslist.pb
RevisitationBloomfilter
RevisitationBloomfilter~RFe60b412.TMP
Filtering Rules
LICENSE
typosquatting_list.pb
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
MSID805.tmp
MSID95E.tmp
4689d672ab93c1d3ce172c44b94e9392440df08d7025216321ba6da445cbffe354a7d9e990d1dc9c416e2e6572de8f02af83a12cbdb76554bf8560472dec
5296f26e207d1371c8f95bf082321237691bc5e5db64b66d0ffd6ffa99ab
dc0e50fd65dcc546441ad6d8b83ba84ba2801a6689a7c389906561634ac1
c335f15c5e60271d167b8468ee446614a76a1bee37e0fcc08643dc5818a4
7d0ac147818ea1892350f9c3f49b22c27f3d1f279ead6de0f28c314c285d
04dc3b5f-145b-4fc4-840d-53ba7c85c52e
132e608b-19ed-440a-97c0-7011fc636048
1e89bbcb-4cc0-414d-869e-afdbbc81c8a1
21f8b488-c717-4331-b17a-66af40a21662
3c6d0ad4-1fce-49cb-95a3-711ef9773f58
4fd40e55-988f-4e74-b2c6-fb57a404d6a9
55b733a6-0460-4f8d-8a4d-53df373b2139
6d51d094-7fdf-46a4-abd2-8664ee34b5e9
725f29a0-5848-4535-a7b1-666fbf3e4186
7ccc9fb8-a90e-4b55-8f4c-be0824001a3e
8a2d236c-c1be-411b-9394-7308f1cceac7
9b34f5b6-615b-4606-828c-b6a5284545d8
b773ce2f-88a8-41cd-bd91-26802b9a04a4
bb62ec7d-8cf9-4d64-891a-d39deb18f594
c41f5a43-6b5f-4c08-b547-1a3caa41b392
cc4ab828-d563-4461-ada5-f9582bd40aef
d44bbaef-18cb-4963-a9d2-6c844734beb6
e3c6f329-4a77-4e10-b97b-b6761153c366
e3f1d96a-306d-46e8-a7be-5b46ed9994ce
e8b9af7b-717c-46cc-88b4-c4bb49ae8f00
f1b00128-422b-42bb-9c98-43e62f90e3a2
ffab65bc-d67e-480f-b9e5-3a6c30728ae5
default.dic
the-real-index
the-real-index
data_0
data_1
data_2
data_3
Network Persistent State
Network Persistent State~RFe643161.TMP
config.json
semver
semver.cmd
semver.ps1
node-v24.15.0-x64.msi
memory/712-9421-0x00007FF955550000-0x00007FF955551000-memory.dmp
memory/712-9420-0x00007FF957290000-0x00007FF957291000-memory.dmp
memory/1048-11128-0x000001B3C9040000-0x000001B3C910D000-memory.dmp
memory/1068-4450-0x000002653F7D0000-0x000002653F89D000-memory.dmp
memory/1068-3617-0x000002653F7D0000-0x000002653F89D000-memory.dmp
memory/1104-2515-0x0000016665260000-0x000001666532D000-memory.dmp
memory/1624-4447-0x0000000000400000-0x0000000000445000-memory.dmp
memory/1624-4448-0x00000000001E0000-0x00000000001F9000-memory.dmp
memory/3468-3614-0x000001A343580000-0x000001A34364D000-memory.dmp
memory/3468-4460-0x000001A343580000-0x000001A34364D000-memory.dmp
memory/4484-369-0x0000023C68800000-0x0000023C688CD000-memory.dmp
memory/4808-2505-0x000001B1850E0000-0x000001B1851AD000-memory.dmp
memory/4808-4459-0x000001B1850E0000-0x000001B1851AD000-memory.dmp
memory/5124-11134-0x00000288B9900000-0x00000288B99CD000-memory.dmp
memory/5792-4449-0x000001A0BA570000-0x000001A0BA63D000-memory.dmp
memory/5820-154-0x000001D972BF0000-0x000001D972CBD000-memory.dmp
memory/6020-2540-0x000001E407390000-0x000001E407398000-memory.dmp