Analysis
- user interaction
yes - max time kernel
814s - max time network
809s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
05/08/2026, 00:05
General
- Target s.html
- Size 22KB
- Sample260805-adh2laaf55
- SHA256 65aad0a3587444bc5342e65978610928fbe665515ae650ef7ca077c5cb85a70f
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 1 IoCs
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 40 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 7 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\s.html1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7ffa7ba0c188,0x7ffa7ba0c194,0x7ffa7ba0c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,15610513486474599341,17926917072085229590,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,10675009185831283051,14190901872389594126,262144 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,18154561890796718914,17014385120797528877,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,4496216241012914762,7609825737841971872,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,10485915291804897581,10568866940576646018,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,34022063678097772,15382361107182364343,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,17364046210299231904,13612317182279810044,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4324,i,15013728107604660180,14377675724298769186,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4312,i,12387814939401510302,14911584663746389350,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,16492191069632356905,5560347139400348009,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,17557970359612071229,17921874886923040785,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1349391723014197744,12165291608143546175,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,17735344161463727804,16283633025212263034,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11243⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1349391723014197744,12165291608143546175,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,4790226270213796678,7519692164389339865,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,14664849527284660038,1876042716827630375,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,3426987858014173773,10571095614705220389,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,779754623265299016,13067168559756839607,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6572,i,976312424465750721,10356059557581011933,262144 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,11443478478621615985,15307758188444039087,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,3101917384792901563,5249227157757068478,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,4638442556738617807,1707167751454894704,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,13994447251132824203,10663094196896095725,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5928,i,16792065456990875917,14433773297110796197,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6644,i,8366942613324844285,11297227882424422693,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6648,i,6935965122149812861,3854392866314094652,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6800,i,11088794204697450382,17370885069817882466,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6888,i,992481217005541527,16245510396400118865,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6940,i,18425846342009174561,10056760122299470109,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6128,i,13795451520774469554,18428824702722852400,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7228,i,12767172611890664616,13897160700357638596,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7116,i,7299050629886253281,13663557900251663592,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=7432,i,5150772389420299889,17385544003711858679,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5200,i,851822540820905761,6600744818602670018,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7608 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7776,i,12448346916509381405,13387786468216537854,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7908,i,6010065483355008930,16996435777488854499,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8224,i,13429389992435354780,10926026354466260345,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8228,i,11321027747433459460,7562545414916517177,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8244 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8464,i,1443827844202450034,12442461437345741521,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8460 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8688,i,8556619343742773082,6592266892865748663,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8640,i,5806652940737826789,4226214022010918428,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=8936,i,10564578840602604062,1399450122003243236,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=9120,i,4402077599015382356,6198283518003305763,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8432,i,16376941145418493871,99340255239653,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8512,i,17099707019743219458,7169133382442159979,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8552,i,17507992292442217602,5569202440061979082,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=9424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8512,i,14770461208483262825,14253695990504677895,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8540 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=9152,i,5830823928372623346,3478861410752611400,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9220,i,6126764295473401519,5260855451968437268,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8516 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\BootstrapperNew.exe"C:\Users\Admin\Downloads\BootstrapperNew.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\BootstrapperNew.exe"C:\Users\Admin\Downloads\BootstrapperNew.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10248,i,5636733980020723017,9457363324934128586,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=9872 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9860,i,12560748399518244137,9702858506287655047,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=9324 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9456,i,15884533770870315352,8371182039292552698,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8916,i,10286073116467813636,17013132448795347556,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=9500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=9480,i,17707660841940687911,7034776096852446765,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=9408 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9724,i,11985094588165040749,11415882366210275773,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=9092 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=10932,i,1004381013500115262,3313717616425386381,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=10908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10684,i,3959825357668896705,630807042883503736,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=10696 /prefetch:142⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=10684,i,9916331930147075141,8330722097379749800,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=11408,i,7551703162587319884,1622839395186608374,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=11444,i,12130875740645291436,7660330860962640535,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=11296,i,10311517858350209632,13370943571053554197,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11452 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11004,i,10349558049394821959,13660913014527828217,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11480 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=11160,i,5595052847144865700,12446545235351860997,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=10980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=3592,i,9994367201698992141,6238109325435674463,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11528,i,10373445447939707114,6006689393566105579,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=10588 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8216,i,878034762649482285,16089018170723472600,2097152 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=8188 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=11376,i,3591663399784952484,12655606476274440006,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=10896 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=10904,i,6472640428787671266,1710718026210818121,524288 --field-trial-handle=2128,i,15125903519293824864,9710946095567316102,262144 --variations-seed-version --mojo-platform-channel-handle=11616 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
54C62B182F5BF07FA8427C07B0A3AAF8_4DBBCB40FA282C06F1543D887F4F4DCC
A71F9E6AF1EDB5F61A1EABEAC6EE27B2_D62B1A6E7A25E8AED631F57A5AAB219E
BootstrapperNew.exe.log
settings.dat
settings.dat
062cad73-fc45-4f46-a826-e2752b750987.tmp
LOG.old
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_00007f
f_000081
f_00008d
f_00008e
f_00008f
f_000091
f_000092
f_000094
f_000095
f_000096
f_000097
f_000099
f_00009b
f_00009c
f_00009f
f_0000af
f_0000b8
f_0000ce
f_0000f7
f_0000f8
f_0000f9
f_0000fa
f_0000fb
f_00010a
f_00010d
f_00011c
f_000130
f_000165
f_000176
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
000003.log
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe5facb4.TMP
TransportSecurity
TransportSecurity~RFe6412ec.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe602213.TMP
the-real-index
the-real-index
the-real-index~RFe5cd77c.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
f1cdccba37924bda_0
f1cdccba37924bda_1
the-real-index
the-real-index
the-real-index~RFe5f5d2c.TMP
sync_diagnostic.log
the-real-index
the-real-index~RFe634972.TMP
index
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe5f97a5.TMP
000003.log
CURRENT
LOG
the-real-index
the-real-index~RFe63713e.TMP
index.txt
index.txt
index.txt~RFe5ff16e.TMP
OperationConfig
OperationConfig~RFe592800.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5f3d12.TMP
data_1
metadata.json
microsoftwindows.client[2].xml
microsoftwindows.client[2].xml
ccba5a5986c77e43.customDestinations-ms
BootstrapperNew.exe
BootstrapperNew.exe:Zone.Identifier
memory/984-468-0x0000022E7C350000-0x0000022E7C450000-memory.dmp
memory/984-347-0x0000022E56510000-0x0000022E56610000-memory.dmp
memory/984-398-0x0000022E69910000-0x0000022E69930000-memory.dmp
memory/984-397-0x0000022E69930000-0x0000022E69950000-memory.dmp
memory/984-379-0x0000022E699D0000-0x0000022E699F0000-memory.dmp
memory/984-340-0x0000022E566D0000-0x0000022E567D0000-memory.dmp
memory/984-341-0x0000022E566D0000-0x0000022E567D0000-memory.dmp
memory/984-342-0x0000022E566D0000-0x0000022E567D0000-memory.dmp
memory/984-361-0x0000022E67BE0000-0x0000022E67C00000-memory.dmp
memory/4832-2632-0x000001F34BC90000-0x000001F34BD42000-memory.dmp
memory/4832-2633-0x000001F3439C0000-0x000001F3439E2000-memory.dmp
memory/5128-2378-0x00000167787B0000-0x00000167787B8000-memory.dmp
memory/5128-2380-0x0000016774B20000-0x0000016774B58000-memory.dmp
memory/5128-2381-0x0000016774AF0000-0x0000016774AFE000-memory.dmp
memory/5128-2377-0x000001675A660000-0x000001675A670000-memory.dmp
memory/5128-2376-0x00000167599E0000-0x000001675A226000-memory.dmp