Analysis
- geolocation tags
- user interaction
yes - max time kernel
887s - max time network
901s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
07/08/2026, 00:51
General
- Target 4Okj66.html
- Size 11KB
- Sample260807-a7zansvbpb
- SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 12 IoCs
- Loads dropped DLL 5 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 5 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Network Share Discovery 1 TTPs
Attempt to gather information on host network.
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 64 IoCs
- Hide Artifacts: Ignore Process Interrupts 1 TTPs 1 IoCs
Command interpreters often include specific commands/flags that ignore errors and other hangups.
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- System Network Connections Discovery 1 TTPs 1 IoCs
Attempt to get a listing of network connections.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 18 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Modifies Internet Explorer settings 1 TTPs 20 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 4 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 55 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 52 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\4Okj66.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a4,0x7ffdd003c188,0x7ffdd003c194,0x7ffdd003c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,11645197604014270568,1267811982951047519,262144 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=2836 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,15037078254440033150,17849923849120645307,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,7301156471780828032,8981408040599586716,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,627316037229528829,11154206924089138151,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,18064408649846464601,12134614882572959615,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4124,i,17424635055103727310,14203786078411580536,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,7124948482767729044,1045408743025413375,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4176,i,14186345936657626279,18096992274682417204,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4188,i,4292603240912763707,2017797258086017973,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,16496553049106571020,18296994777482759199,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,2907730875112500648,14095162506956994765,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,13796786568393473960,11910917330283499525,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,13796786568393473960,11910917330283499525,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,17709589200345328542,11371393862337060115,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11323⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,13791828866424973972,10150223388147860766,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,14431071360923216942,9178103656378975105,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,5208268518663668180,4899209864792224725,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,7093173007539643407,1916200970962972287,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6576,i,7137055692559935835,1419675613406270092,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4756,i,17131889285858407071,874722260800999185,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,8405777916473942325,9210973227661897698,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7012,i,2247914373574868093,6475276027860948926,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6556,i,12151998757853984487,6026230175020767847,262144 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,11466163582738407656,8855706886272479924,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,12348401625103656350,4615371918382250961,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10390847159706942144,11047343238278806664,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,2791098293855748835,2604128374734089050,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,3720920626344123624,16973450103149861383,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6596,i,10947463011802694698,1132960280281452096,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5644,i,13689530675100250989,18200820059644567538,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6588,i,12514358676784764097,11466129403038896984,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4832,i,12676317136524806027,16161185531946945411,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4684,i,5754022446869807622,4858165870498112052,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5308,i,15745272654143299942,3088246326392101194,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7280,i,1210663585802066694,5891959555740457869,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,3618829620161002966,10744084836610172984,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5648,i,7108695949012576883,5181034189391921606,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7532,i,11629129249815289740,10841328989989335661,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=4928,i,18028765838076386521,4988209958653958389,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7300,i,17915040155293962259,17736631879947957262,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,8535756535269215618,9148750820862322907,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7164,i,13410875181944133096,2136053392384484439,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7392,i,14590772114124540134,16065596991835766303,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,8087059456880677283,16456395871093739385,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=7432,i,5213193732456213639,8594434118284447221,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=7544,i,11723940298140594381,17957543541841906113,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8724,i,9299193643715275738,17464260921385999172,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=7692,i,2613812364636836939,1368585671869728338,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8520 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=7764,i,4718330067122706738,427134847611195141,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=9024,i,1281527611520188484,13780418643744614987,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9000 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9044,i,8726596101977389933,622516798774701415,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9164 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9308,i,12908628825270829478,11932495274442465607,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9348 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9192,i,9055607459557084779,4613832045078683626,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9300 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=7240,i,5777649789572185159,10492182664365150454,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8840,i,12628695806814303349,13468331171555163931,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8800 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8832,i,3474822031800323519,3280295865436361739,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7188,i,7232290833211496000,5720074933370004491,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=7196,i,18258627314455354531,8186983858970267213,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9096,i,16087817527361843361,5505424797618983547,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7448,i,437078945975897704,8235674754308515366,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8808 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9108,i,6978983915502162529,7719085587632603716,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9176,i,10358135596570362721,15082735319827115009,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8008 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=8780,i,9002343169890518383,15406432884340339773,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=7328,i,13268186629695648098,7589349271240909502,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=9012,i,57806435118496466,7443073055515527025,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9120 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=5572,i,350849606815732902,6851329481531713101,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7776 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=9624,i,363125910524251476,9670221704222657494,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8904,i,15031970240958235158,7392083231329252629,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8628 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=7948,i,10028464755926436435,6678960202615604441,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9160,i,4735294516500004787,7210620561526707354,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=7492,i,15936403109387318696,13373828390678801726,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=7128,i,2928082902260413525,12739688295941514024,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=6692,i,8154471372431737804,8846407610300565353,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8576,i,7933349555854971208,2386280738745584648,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --always-read-main-dll --metrics-shmem-handle=6692,i,12604883079691324082,7987735154950722707,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8100 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=9708,i,16829585993039208982,3039475614118755211,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --always-read-main-dll --metrics-shmem-handle=9672,i,2296139048990106726,10446166140368773866,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --always-read-main-dll --metrics-shmem-handle=9776,i,18039704554754036270,16916132613468379742,2097152 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=8152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9768,i,7597475189688488872,2948703610817488634,524288 --field-trial-handle=2896,i,12565727785922331836,5340891581172744736,262144 --variations-seed-version --mojo-platform-channel-handle=9952 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-Q2RPFFXYD3.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-Q2RPFFXYD3.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -personalizedToken Q2RPFFXYD3 --deeplink https://www.roblox.com/games/10449761463/The-Strongest-Battlegrounds --webBtid 1786064573672004 --downloadSource web_game_join --authenticationTicket ZGBJP6Uxcp_KyD2KF77YfI2lzFK40EwIboFyPLxN6S3Vur19Ldtqfoi80aE0fCB4hrmWmzZyCGGUAARyo9djBGsinwiqQ4QBdN_pD0UVdfkFPRbp0jAhKVoHY5pLhsrG69HP18bvYIKK6GVOqH_NblOV79IpHdERf7Y9gY_EfnZDm0SfIusi6Dj1tv-KupFHVeU5AmTihOSwwKPQyqiNUFzAWHRfX0gVhY48hewiHwxkotS86IHp0rfeI6rrzHAZnu-1ABmP9E1NuQgFNXiWWAuT3_9on7MigK39vEd5X4qw9jRLD7Kbvh_grAUOzwqLdGDsHjNP8_GN0TFvK-kA1jptJhbVkBlghBEzoe9BcjbBG-culbbNzsZVQ3jrw5ZDiXoWjfoRDcpAH3n36ZUzlompK36l2YP8aGim4pHOzxjvfwM-ZrwQfKswMfMk2YJT43Npb8LRYANv5LDzkMQ_NVXSMYdHVNSDKsuQ1Cz0HoYw9PLg90_Q29y6e8MTM7KXgvaoZekBTFxDSic7GqFQwGyc2mbrHVE2alK95RI7NL_A3F7JQSfccI9-0JBgzE8p -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 68883⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\tj43t1\" -spe -an -ai#7zMap26240:74:7zEvent286013⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\tj43t1\UI.exe"C:\Users\Admin\Downloads\tj43t1\UI.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH4⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" -NoProfile -Command "(Get-NetTCPConnection -LocalPort 24950 -State Listen -ErrorAction SilentlyContinue).OwningProcess"4⤵
- Hide Artifacts: Ignore Process Interrupts
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\netstat.exe"netstat" -ano -p TCP4⤵
- System Network Connections Discovery
- Gathers network information
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=4836.1372.27653162538648289134⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0xec,0xf8,0x148,0xf4,0x170,0x7ffdba73b078,0x7ffdba73b084,0x7ffdba73b0905⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1724,i,1987377136582295319,3781536775645234145,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1896,i,1987377136582295319,3781536775645234145,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2032 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2316,i,1987377136582295319,3781536775645234145,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3532,i,1987377136582295319,3781536775645234145,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:15⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\cmd.exe"cmd" /c start "" /b C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat4⤵
- Executes a command shell one-liner
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\AppData\Local\Temp\cosmic_ui_update.bat5⤵
- Executes a command shell one-liner
-
C:\Windows\system32\PING.EXEping 127.0.0.1 -n 26⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
-
-
C:\Users\Admin\Downloads\tj43t1\UI.exe"C:\Users\Admin\Downloads\tj43t1\UI.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Windows\system32\tasklist.exe"tasklist" /FI "IMAGENAME eq UI.exe" /FO CSV /NH7⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=7020.7120.70454438268485628147⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x140,0x1a4,0x7ffdba73b078,0x7ffdba73b084,0x7ffdba73b0908⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1760,i,9956553105086264317,2274541470862783288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:28⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1672,i,9956553105086264317,2274541470862783288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1940 /prefetch:118⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2092,i,9956553105086264317,2274541470862783288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:138⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=UI.exe --webview-exe-version=1.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3516,i,9956553105086264317,2274541470862783288,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:18⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Discovers running processes
-
-
C:\Users\Admin\Downloads\tj43t1\bin\lsp\lsp.exe"C:\Users\Admin\Downloads\tj43t1\bin\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\Downloads\tj43t1\bin\lsp\globalTypes.d.luau --docs=C:\Users\Admin\Downloads\tj43t1\bin\lsp\docs.json --definitions=C:\Users\Admin\Downloads\tj43t1\bin\lsp\sunc.d.lua --definitions=C:\Users\Admin\Downloads\tj43t1\bin\lsp\synx.d.lua7⤵
- Executes dropped EXE
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"7⤵
- Discovers running processes
-
-
-
-
-
-
C:\Users\Admin\Downloads\subscribe.exe"C:\Users\Admin\Downloads\subscribe.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --lang=en-US --mojo-named-platform-channel-pipe=6992.6968.103420949495994581504⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x164,0x168,0x16c,0x144,0x174,0x7ffdba73b078,0x7ffdba73b084,0x7ffdba73b0905⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1972,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1700,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:115⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1764,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --always-read-main-dll --field-trial-handle=3432,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=756,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4592,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4136,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4108 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4092,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.savage.cosmic\EBWebView" --webview-exe-name=subscribe.exe --webview-exe-version=1.0.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4060,i,1160516054534833751,16491250207611809047,262144 --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:145⤵
-
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Users\Admin\Downloads\bin\lsp\lsp.exe"C:\Users\Admin\Downloads\bin\lsp\lsp.exe" lsp --definitions=C:\Users\Admin\Downloads\bin\lsp\globalTypes.d.luau --docs=C:\Users\Admin\Downloads\bin\lsp\docs.json --definitions=C:\Users\Admin\Downloads\bin\lsp\sunc.d.lua --definitions=C:\Users\Admin\Downloads\bin\lsp\synx.d.lua4⤵
- Executes dropped EXE
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
- Discovers running processes
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
C:\Windows\system32\tasklist.exe"tasklist"4⤵
-
-
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-Q2RPFFXYD3.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-Q2RPFFXYD3.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe" -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 38044⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-d584fb6c717a43d9\RobloxPlayerBeta.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Hide Artifacts
1Ignore Process Interrupts
1Modify Registry
2Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Discovery
Browser Information Discovery
1Network Share Discovery
1Peripheral Device Discovery
2Process Discovery
1Query Registry
5Remote System Discovery
1System Information Discovery
6System Network Configuration Discovery
1Internet Connection Discovery
1System Network Connections Discovery
1System Time Discovery
1Replay Monitor
Loading Replay Monitor...
Downloads
RobloxStudioInstaller.exe
blocklist
settings.dat
settings.dat
78ef1130-79b7-4089-9279-fa86be90f6c9.tmp
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_00006e
f_00006f
f_000070
f_000071
f_000072
f_000073
f_000075
f_000076
f_000080
f_000081
f_000082
f_000083
f_000084
f_0000ac
f_0000ad
f_0000ae
f_0000b4
f_0001ae
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe58f8b3.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe5f962e.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
the-real-index
the-real-index~RFe5d3eb1.TMP
index.txt
sync_diagnostic.log
the-real-index
the-real-index~RFe60bac8.TMP
index.txt
index.txt~RFe606c0c.TMP
bdef5d64-fc39-4e66-8c1b-bafb73ee5e1d.tmp
5bc8b81d-078f-43d5-a24c-9e8a9d73dcf6.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59a80e.TMP
metadata.json
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
www.bing[1].xml
Apps.ft
Apps.index
AppCache134305382929751759.txt
SearchHoverUnifiedTileModelCache.dat
d444176101c29a0b4a4edaee7215443a
__PSScriptPolicyTest_xhazluak.a4e.ps1
cosmic_ui_update.bat
crl-set
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
throttle_store.dat
the-real-index
the-real-index
the-real-index
the-real-index~RFe60bf2d.TMP
data_0
data_1
data_2
data_3
MANIFEST-000001
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
000001.dbtmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State~RFe60a220.TMP
crs.pb
ct_config.pb
kp_pinslist.pb
Filtering Rules
LICENSE
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
ui-state.json
f01b4d95cf55d32a.automaticDestinations-ms
lsp.exe
subscribe.exe
tj43t1.rar
tj43t1.rar:Zone.Identifier
UI.exe
ui_update.exe
ytwdcc.7z.crdownload
adblock_snippet.js
manifest.json
manifest.json
hyph-as.hyb
hyph-mr.hyb
hyph-nb.hyb
manifest.json
manifest.json
memory/3780-5207-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5205-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5206-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5208-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5209-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5210-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5201-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5200-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5199-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3780-5211-0x000001F88C180000-0x000001F88C181000-memory.dmp
memory/3892-6323-0x00000195FA010000-0x00000195FA110000-memory.dmp
memory/3892-6775-0x00000194E5B40000-0x00000194E5C40000-memory.dmp
memory/3892-5604-0x00000196F9C00000-0x00000196F9D00000-memory.dmp
memory/3892-5700-0x00000195FA010000-0x00000195FA110000-memory.dmp
memory/3892-5701-0x00000195FA010000-0x00000195FA110000-memory.dmp
memory/3892-5730-0x00000195F8BE0000-0x00000195F8C00000-memory.dmp
memory/3892-5782-0x00000195FE550000-0x00000195FE650000-memory.dmp
memory/3892-5857-0x00000194D2A00000-0x00000194D2B00000-memory.dmp
memory/3892-5915-0x00000195F62B0000-0x00000195F63B0000-memory.dmp
memory/3892-5914-0x00000195F8AB0000-0x00000195F8BB0000-memory.dmp
memory/3892-5916-0x00000195F61B0000-0x00000195F62B0000-memory.dmp
memory/3892-6014-0x00000195E4A20000-0x00000195E4A40000-memory.dmp
memory/3892-6134-0x00000195F64B0000-0x00000195F65B0000-memory.dmp
memory/3892-6133-0x00000195F63B0000-0x00000195F64B0000-memory.dmp
memory/3892-6132-0x00000195FE550000-0x00000195FE650000-memory.dmp
memory/3892-6267-0x00000195F9F10000-0x00000195FA010000-memory.dmp
memory/3892-6265-0x00000196F9C00000-0x00000196F9D00000-memory.dmp
memory/3892-6320-0x00000195FA110000-0x00000195FA210000-memory.dmp
memory/3892-6319-0x00000195FA110000-0x00000195FA210000-memory.dmp
memory/3892-5287-0x00000195F8870000-0x00000195F8970000-memory.dmp
memory/3892-6452-0x00000195FE650000-0x00000195FE750000-memory.dmp
memory/3892-6454-0x00000195FE650000-0x00000195FE750000-memory.dmp
memory/3892-6651-0x00000196F9C00000-0x00000196F9D00000-memory.dmp
memory/3892-6653-0x00000194E5B40000-0x00000194E5C40000-memory.dmp
memory/3892-5475-0x00000195F8AB0000-0x00000195F8BB0000-memory.dmp
memory/3892-5285-0x00000195F8870000-0x00000195F8970000-memory.dmp
memory/3892-5474-0x00000195E4330000-0x00000195E4430000-memory.dmp
memory/3892-5284-0x00000195F8870000-0x00000195F8970000-memory.dmp
memory/3892-5286-0x00000195F64B0000-0x00000195F65B0000-memory.dmp
memory/3892-501-0x00000194D14C0000-0x00000194D15C0000-memory.dmp
memory/3892-8478-0x00000194E5610000-0x00000194E5710000-memory.dmp
memory/3892-517-0x00000194D1310000-0x00000194D1410000-memory.dmp
memory/3892-543-0x00000195E4520000-0x00000195E4540000-memory.dmp
memory/3892-552-0x00000194D2EB0000-0x00000194D2ED0000-memory.dmp
memory/3892-627-0x00000195E4330000-0x00000195E4430000-memory.dmp
memory/3892-636-0x00000195F62B0000-0x00000195F63B0000-memory.dmp
memory/3892-7316-0x00000195E5420000-0x00000195E5520000-memory.dmp
memory/3892-7317-0x00000195FE650000-0x00000195FE750000-memory.dmp
memory/3892-7320-0x00000195FE650000-0x00000195FE750000-memory.dmp
memory/3892-642-0x00000195F69A0000-0x00000195F6AA0000-memory.dmp
memory/3892-634-0x00000195F61B0000-0x00000195F62B0000-memory.dmp
memory/3892-635-0x00000195E4330000-0x00000195E4430000-memory.dmp
memory/4184-1492-0x0000015CC3050000-0x0000015CC3072000-memory.dmp
memory/4184-1505-0x0000015CDB330000-0x0000015CDB34C000-memory.dmp
memory/4184-1506-0x0000015CDB390000-0x0000015CDB443000-memory.dmp
memory/4184-1507-0x0000015CDB310000-0x0000015CDB31A000-memory.dmp
memory/4184-1508-0x0000015CDB450000-0x0000015CDB46C000-memory.dmp
memory/4864-1536-0x00007FFDDE7F0000-0x00007FFDDE7F1000-memory.dmp
memory/4928-1647-0x00007FFDDE7F0000-0x00007FFDDE7F1000-memory.dmp