Analysis
- user interaction
yes - max time kernel
390s - max time network
391s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
18/07/2026, 11:18
General
- Target .html
- Size 5KB
- Sample260718-necsvshw9m
- SHA256 e4226b486ac243fe836f680c7eddd37b823057763abce902747e5a6e40132f0c
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 2 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 4 IoCs
- Checks system information in the registry 2 TTPs 1 IoCs
System information is often read in order to detect sandboxing environments.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 31 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Control Panel 6 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: LoadsDriver 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 39 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 40 IoCs
- Suspicious use of SetWindowsHookEx 14 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x294,0x7ff871f1c188,0x7ff871f1c194,0x7ff871f1c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,6878805991941373947,820454991747281464,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7124008185170903699,12867258914683459265,262144 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,2033036777608309086,15886925714438610517,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,12042447787338215150,3146762080878372800,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,4720172613368179030,13467758455384655166,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,4028608970033864320,1243528917502564797,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,1875608642649183288,3624550840784665093,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,8592851575314290848,6169409046594308702,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,8716434563819767018,2959212383007982555,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14118874784836791798,8450244111274463970,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14118874784836791798,8450244111274463970,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,12657875095110974095,13178449371424819018,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7984941113272395270,18178964675785376486,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,3872074828501477058,18096676610304625382,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,15380103717240274730,10058554225740888224,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,10426353051696756710,11587038106190032440,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5168,i,1528096521230575410,9102756748816814282,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5240,i,15732093690824863738,10915083777702740688,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6880,i,14794675337166340189,12714309323062235519,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,9284799066407739613,11072072523725674136,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7080,i,13949287168447376780,18152449634608374809,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5616,i,13001085596229557591,2912250125484826453,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6632,i,3426846382107845185,17678669093721047833,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7140,i,5396803715340951521,11650510824320953815,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6644,i,16899193351194353954,14976505718555062551,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3448,i,17244288935370700321,5256620585893968218,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7336,i,3960151979949347436,9763399837674633635,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5340,i,18378235391973271576,6969440059728504530,262144 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=3088,i,9724086261449681772,7952735359940996886,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,5394294295683615348,10419620117807337906,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,13535358631051496711,10709918000550636270,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7600,i,16784650522933298526,14308819038861188232,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5408,i,5400049659936694379,5195825014820800373,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=6580,i,11207100270709928583,18065124112339448387,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7760 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7856,i,113164499233686640,12132151847143109318,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7808,i,6899541435934531002,15580184711496336718,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7868,i,17120379985717947567,14458924899190931517,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8476,i,7669032104116424427,990951452329839923,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Firefox Installer.exe"C:\Users\Admin\Downloads\Firefox Installer.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS46799FAB\setup-stub.exe.\setup-stub.exe3⤵
- Downloads MZ/PE file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\nsrF54A.tmp\download.exe"C:\Users\Admin\AppData\Local\Temp\nsrF54A.tmp\download.exe" /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsrF54A.tmp\config.ini4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zS854A271C\setup.exe.\setup.exe /LaunchedFromStub /INI=C:\Users\Admin\AppData\Local\Temp\nsrF54A.tmp\config.ini5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\Mozilla Firefox\AccessibleMarshal.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice_tmp.exe" install7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Mozilla Firefox\default-browser-agent.exe"C:\Program Files\Mozilla Firefox\default-browser-agent.exe" register-task 308046B0AF4A39CB6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB7⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask defaultagent register-task 308046B0AF4A39CB8⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies Control Panel
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "4312" "\\.\pipe\gecko-crash-server-pipe.4312" "C:\Users\Admin\AppData\Local\Temp\\" "744" "756" "832"9⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install6⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask install7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies Control Panel
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "3820" "\\.\pipe\gecko-crash-server-pipe.3820" "C:\Users\Admin\AppData\Local\Temp\\" "736" "748" "832"8⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startup4⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -reset-profile -migration -first-startup5⤵
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks system information in the registry
- Drops file in Program Files directory
- Checks processor information in registry
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "1496" "\\.\pipe\gecko-crash-server-pipe.1496" "C:\Users\Admin\AppData\Local\Temp\\" "748" "760" "784"6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260713164047 -prefsHandle 1972:25807 -prefMapHandle 1976:293722 -ipcHandle 2020 -initialChannelId {575adffe-4017-4582-ae63-6377d8a27298} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 2028 -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260713164047 -prefsHandle 2224:25807 -prefMapHandle 2228:293722 -ipcHandle 2252 -initialChannelId {0abf5162-019d-42a5-9186-adafa2d566e3} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 2248 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3208:31347 -prefMapHandle 3268:293722 -jsInitHandle 3276:156120 -parentBuildID 20260713164047 -ipcHandle 2544 -initialChannelId {15d040b4-c9be-4228-a4b0-87844728c26c} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 3236 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260713164047 -prefsHandle 4040:32202 -prefMapHandle 4044:293722 -ipcHandle 4112 -initialChannelId {c621d7a4-123a-403f-b80d-bb6f88a16944} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 4120 -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd6⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3992:32396 -prefMapHandle 3988:293722 -jsInitHandle 3140:156120 -parentBuildID 20260713164047 -ipcHandle 4300 -initialChannelId {e791d62d-4efa-4ebd-b9d9-2e29a109e1cf} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 4308 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260713164047 -sandboxingKind 0 -prefsHandle 5112:35140 -prefMapHandle 5116:293722 -ipcHandle 5156 -initialChannelId {3d59072d-f6ba-44da-b16e-92bcb30520e7} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 5192 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5140:33325 -prefMapHandle 5144:293722 -jsInitHandle 5148:156120 -parentBuildID 20260713164047 -ipcHandle 5164 -initialChannelId {128b0aba-ae11-4de9-aa77-6f5322b9ea80} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 2984 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5496:33371 -prefMapHandle 5500:293722 -jsInitHandle 5504:156120 -parentBuildID 20260713164047 -ipcHandle 5536 -initialChannelId {5347c813-a0fd-4621-bab1-69243a0e5561} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 5552 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5520:33371 -prefMapHandle 5524:293722 -jsInitHandle 5528:156120 -parentBuildID 20260713164047 -ipcHandle 5544 -initialChannelId {bb8b91af-42db-4491-84f5-4fd5f8ff8608} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 5560 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6340:48586 -prefMapHandle 3872:293722 -jsInitHandle 3888:156120 -parentBuildID 20260713164047 -ipcHandle 4976 -initialChannelId {a4356a1d-87c0-49c7-ad2f-b30e123e66a3} -parentPid 1496 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1496" -crashHelperPid 0 -crashHelper 3100 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab6⤵
- Executes dropped EXE
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --ping-cleanup "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports" false6⤵
- Executes dropped EXE
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\i2r6klgt.default-release-1784373775731\minidumps\dcde28a3-9483-4e22-8c92-126b12efd605.dmp"6⤵
- Executes dropped EXE
- Modifies Control Panel
-
C:\Program Files\Mozilla Firefox\crashreporter.exe"C:\Program Files\Mozilla Firefox\crashreporter.exe" --memtest 1024 {\"timeout\":{\"secs\":3,\"nanos\":0},\"mem_lock_mode\":\"Resizable\",\"allow_working_set_resize\":true,\"allow_multithread\":true,\"allow_early_termination\":true}7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask crashreporterNetworkBackend https://incoming.telemetry.mozilla.org/submit/firefox-crashreporter/crash/1/13c8b2c8-cfb4-45e6-87f4-3384cf86d150 "crashreporter/152.0.6 (windows x86_64)" C:\Users\Admin\AppData\Local\Temp\crashreporter3040-request0.json7⤵
- Executes dropped EXE
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" --backgroundtask crashreporterNetworkBackend https://incoming.telemetry.mozilla.org/submit/firefox-crashreporter/crash/1/13c8b2c8-cfb4-45e6-87f4-3384cf86d150 "crashreporter/152.0.6 (windows x86_64)" C:\Users\Admin\AppData\Local\Temp\crashreporter3040-request0.json8⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies Control Panel
-
C:\Program Files\Mozilla Firefox\crashhelper.exe"C:\Program Files\Mozilla Firefox\crashhelper.exe" "7888" "\\.\pipe\gecko-crash-server-pipe.7888" "C:\Users\Admin\AppData\Local\Temp\\" "732" "744" "816"9⤵
- Executes dropped EXE
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20260713164047 -prefsHandle 1848:29858 -prefMapHandle 1852:298453 -ipcHandle 1796 -initialChannelId {65b945ca-7135-4744-9fdd-4bef055d9f31} -parentPid 7888 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 socket9⤵
- Executes dropped EXE
-
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,13001522631022296124,6354875223543106870,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8036,i,12217734539783254490,10568447567447348613,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7900 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8660,i,16109738181639486232,16742267704399989193,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8736,i,256494963155354136,12902863380034017136,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8900,i,9666985548506475268,9153523617659414130,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8916 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=7968,i,13475853309330943115,17311879260608710320,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7980,i,5393828575452524734,13855997257783221315,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8632 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8696,i,2562594898634822078,13737888917545588506,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8740,i,7914142696528868931,13728199249437676486,524288 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8220,i,3022942743167282532,1106261565883976128,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9168,i,3323244658321922590,14650206885852582133,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8948,i,7027554284005908501,6599152589307459389,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=8348,i,7379292736500377459,12080364365154627549,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=9012,i,7294911401476164505,9027276578504675248,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=9380,i,1607286288053415288,11947839675901159748,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9412 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=9012,i,2913788354272292875,4482407744054041710,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9352,i,8787158599057654484,18264788368050139622,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9368 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8012,i,13057830931728282451,13885171746545684006,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8988,i,9942742838006354591,15897102205179802109,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9580,i,2061209227157664906,12196977611920812420,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=9404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=5496,i,575784757964473480,11018377833458958412,2097152 --field-trial-handle=2268,i,15942179974784263257,10312582291919690847,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
InstallationDirLayout.dll
Microsoft.InputStateManager.dll
Microsoft.Internal.FrameworkUdk.dll
Microsoft.UI.Composition.OSSupport.dll
Microsoft.UI.Input.dll
Microsoft.UI.Windowing.Core.dll
Microsoft.UI.Windowing.dll
PrivateBrowsing_150.png
PrivateBrowsing_70.png
VisualElements_150.png
VisualElements_70.png
omni.ja
channel-prefs.js
desktop-launcher.exe
firefox.VisualElementsManifest.xml
TwemojiMozilla.ttf
freebl3.dll
gkcodecs.dll
clearkey.dll
clearkey.dll.sig
manifest.json
install.log
install.log
install.log
install.tmp
install.tmp
install.tmp
install.tmp
install.tmp
InstallationDirLayout.dll
lgpllibs.dll
libEGL.dll
libGLESv2.dll
maintenanceservice.exe
maintenanceservice_installer.exe
marshal.dll
mozavcodec.dll
mozavutil.dll
mozglue.dll
mozinference.dll
mozwer.dll
msvcp140.dll
msvcp140_atomic_wait.dll
nmhproxy.exe
notificationserver.dll
nss3.dll
omni.ja
onnxruntime.dll
pingsender.exe
platform.ini
plugin-container.exe
plugin-container.exe.sig
precomplete
private_browsing.VisualElementsManifest.xml
private_browsing.exe
removed-files
softokn3.dll
helper.exe
shortcuts_log.ini
update-settings.ini
updater.exe
updater.ini
vcruntime140_1.dll
wmfclearkey.dll
xul.dll.sig
Firefox.lnk
Firefox.lnk
update-config.json
13727946-67b7-4204-850c-18a73610aa23.tmp
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_00008d
f_000091
f_000092
f_000093
f_000094
f_000095
f_0000fe
f_000105
f_000135
f_000138
f_000139
f_00013a
f_00013b
f_00013c
f_00013d
f_00013e
f_00013f
f_000140
f_000144
f_000149
f_00014a
f_00014c
14ff8116b518ca2d_0
1f1c4bba1674fa36_0
25c90b4fb1c6ef85_0
2692617678c042d9_0
3812d992ae39708d_0
45a16ff6d0d9ab5f_0
4e9b18b0f66a7183_0
51438acbcfff1bda_0
53ac5abc87e80789_0
5baafe3bfe18aae9_0
688a4b4b23c2152a_0
6adaaccfc08d2f50_0
90d7d7591a1b39bb_0
92ea216a4e512cc9_0
9dbb949d27873cbc_0
a067705c689d7daf_0
ac4d725d9f8e399d_0
acad1f7103cede7f_0
af2cfcaf6d9b18bc_0
c796a9a28320e412_0
c811b34a4d1fd0bb_0
cab9641eb02b548a_0
d0fa80d4db2d38ea_0
de8842b625efa9e1_0
e427fee57fa1a6ab_0
e6e93144ebbfec47_0
e88e996bb16c52cb_0
e9c7e700cc3e33cf_0
ed2bce91487b3a82_0
f2e4bbad99a372cc_0
f5345f974401453e_0
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58ac87.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
CURRENT
LOG
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe5929f4.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe59382d.TMP
index.txt
the-real-index
the-real-index
the-real-index~RFe599263.TMP
the-real-index
the-real-index
sync_diagnostic.log
30ec8e3e-2027-48c2-bfd7-6c718695ea42.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe591227.TMP
metadata.json
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
activity-stream.discovery_stream.json
activity-stream.shortcut_cache.json
4E3D8FAAF804AAC616BC48BD4AFA8BE284516FCF
9512A4488B00CC053350DAC32D417B4A35C11513
asrouter.ftl
setup-stub.exe
AccessibleMarshal.dll
CoreMessagingXP.dll
application.ini
crashhelper.exe
crashreporter.exe
default-browser-agent.exe
dependentlibs.list
dxcompiler.dll
firefox.exe
firefox.exe.sig
setup.exe
AppAssocReg.dll
CertCheck.dll
CityHash.dll
InetBgDL.dll
System.dll
UAC.dll
UserInfo.dll
WebBrowser.dll
bgstub.jpg
config.ini
installing.html
installing.js
installing_page.css
profile_cleanup.html
profile_cleanup.js
profile_cleanup_page.css
stub_common.css
stub_common.js
AccessControl.dll
ApplicationID.dll
ServicesHelper.dll
ShellLink.dll
components.ini
extensions.ini
liteFirewallW.dll
nsExec.dll
nsJSON.dll
options.ini
shortcuts.ini
remote-settings-startup-bundle-
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
data.safe.bin
data.safe.tmp
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
13c8b2c8-cfb4-45e6-87f4-3384cf86d150
store.json.mozlz4.tmp
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
data.safe.tmp
1e1be9e9-294d-40d1-b21e-dd1a64a76c61
7ac02726-f205-43d3-bf92-e78987ff5345
8f957689-f51b-4aa9-8529-22b9dfc2ddef
94738f9b-8ee6-4afb-86de-c8f110788363
a0db13ee-75ee-4318-8fe5-a6caf50157c8
a1f6acaf-66aa-4d73-9fe6-8c8348aab2f6
extensions.json
extensions.json
favicons.sqlite
places.sqlite
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs-1.js
prefs.js
prefs.js
1657114595AmcateirvtiSty.sqlite
3870112724rsegmnoittet-es.sqlite
3870112724rsegmnoittet-es.sqlite
2823318777ntouromlalnodry--naod.sqlite-shm
3561288849sdhlie.sqlite
memory/5208-3225-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5208-2402-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5988-2227-0x0000000000400000-0x0000000000446000-memory.dmp
memory/5988-2354-0x0000000000400000-0x0000000000446000-memory.dmp