Analysis
- user interaction
yes - max time kernel
321s - max time network
354s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
20/10/2026, 15:24
General
- Target https://sites.google.com/view/qwxasz-ydroqk6696urzc/piracy-evidence
- Sample261020-std2pacb45
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 8 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/qwxasz-ydroqk6696urzc/piracy-evidence1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x240,0x244,0x23c,0x258,0x7ffe7f45c188,0x7ffe7f45c194,0x7ffe7f45c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,10870465458708480075,7972899700609601996,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1548,i,12331942781413651279,13404694044493244121,262144 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,5936977848879570872,13162297833358718303,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,6705183949304061076,1603674857077110346,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,10930131829638507875,3598938468029012779,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,119093561198630877,15139787080137077741,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,4440357638079860843,10920608107961158377,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4232,i,5690945866555577255,17290075557981550963,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4276,i,18199184161083113227,3830371958812646563,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5416,i,8904094399953562488,3677999029753545198,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,16473894315426554421,18182472060718000079,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,15234853577720442899,9750387745015511878,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6020,i,15051360142303322531,4386907077469527361,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,8266512797733011189,2571883008257585450,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3470430844397362002,8094584342508523012,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,3470430844397362002,8094584342508523012,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6936,i,15898530381970583955,4707986897395669956,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7092,i,13721923034675132928,15628508987142211005,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,4449081023315367468,12416545255754365175,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,16018464597131260965,10871417404372459023,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,17055992543182387694,3900071534181723262,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,16536644734690145680,18090126467109739448,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,1459176983320646607,18092220940946458004,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,10248871108553612190,3026263167062768700,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3324,i,9741804136160032467,9221550405216956416,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5668,i,18015716019797964279,17542456762556287984,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5592,i,1276241380793900919,8349014475805094666,262144 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=7612 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,12272616489459475050,95693865453535396,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,659946089854852725,3127385592743019134,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,2353008579028145775,6933515559243615564,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7092,i,9688715875794575335,12878513294816556250,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3284,i,17993194306120576454,1514008644028855673,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=5708,i,15570392097534216271,12822353046297153146,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6516,i,6317201773091752330,534125380503530255,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,8956427029973285761,5413317653452101006,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,422817597562578094,16820373770683268661,524288 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=4216,i,16406868750053068777,14992790993830944309,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8156,i,12020978419952921386,12536181683441235670,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5012,i,3211481600317648181,11552688735371175968,2097152 --field-trial-handle=2216,i,7901892669461712678,14854240365831309038,262144 --variations-seed-version --mojo-platform-channel-handle=7192 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Evidence_of_Violation\" -spe -an -ai#7zMap1593:104:7zEvent61411⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\Evidence_of_Violation\Evidence_of_Violation.docx.exe"C:\Users\Admin\Downloads\Evidence_of_Violation\Evidence_of_Violation.docx.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c GamePanel2⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\GamePanel.exeGamePanel3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3192 -s 4442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3192 -ip 31921⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2ad9dc86-39fd-4d93-b752-1e13d1e5c1b9.tmp
3ca55244-664f-4cbd-81a1-fccbf845f49f.tmp
4c6238c9-24c6-4e74-b6eb-35b9926571a6.tmp
752c3959-0cbe-498b-a94e-11190ecdca13.tmp
8190b199-14c9-4a90-9ed0-8c04cb67a1eb.tmp
8298759c-389f-4c65-893e-4d8985da1e60.tmp
7f1166be-296c-4283-b609-0505df0465c6.tmp
settings.dat
settings.dat
0107bd57-9128-47f2-b05c-be845eeb71c2.tmp
0d7066be-f7e0-47a8-b0f2-217834f8c079.tmp
493d2578-1df1-4ad0-ad20-5c44709a6ce9.tmp
4d6c0f54-23a8-481a-9dad-4cb31aa9d419.tmp
59d81046-bf77-4ec3-9f3a-1de3bbf8076c.tmp
633e2806-5195-487d-95b9-8bf32a754151.tmp
9ec5b01a-2652-49dd-857d-fb946c6de14a.tmp
LOG
LOG
LOG.old
f_000088
f_000089
f_00008a
f_00008b
f_00008d
f_00008e
f_00008f
f_000092
f_000094
f_000096
f_000097
f_000098
f_000099
f_00009a
f_00009d
f_00009e
f_00009f
f_0000a1
f_0000a3
f_0000a5
f_0000ac
f_0000b1
f_0000b8
f_0000c5
f_0000c6
f_0000c7
f_0000c8
f_0000c9
f_0000f2
f_0000f8
temp-index
the-real-index
the-real-index
0222099c-4567-44fa-a7d0-e866ed298413.tmp
4748c8ad-446f-43e4-911f-dab08dd89204.tmp
91faff5b-9599-461b-92e9-746b0b58828b.tmp
Sdch Dictionaries
a38679b6-1576-4342-b9b2-fde75aa9decf.tmp
a53c4d97-a200-480d-838d-a88914e9e172.tmp
temp-index
the-real-index
temp-index
temp-index
the-real-index
index.txt.tmp
temp-index
the-real-index
sync_diagnostic.log
a7bd1b8b-f512-45c9-9ae6-5856e7dc75bf.tmp
e02ec38a-b4a9-49e4-8420-97a317563c73.tmp
OperationConfig
fd706f4f-b2c9-4720-8de9-7a6b055232f5.tmp
RevisitationBloomfilter
db672b35-1623-4301-87e0-35826100ea05.tmp
edf28b3a-47b2-4171-b813-f906b3860c58.tmp
09d56997-d18e-4fea-ab8a-88f24edf618e.tmp
f77521bb-d497-4317-8713-105705cd8386.tmp
Evidence_of_Violation.zip:Zone.Identifier
Evidence_of_Violation.docx.exe
manifest.json
memory/3192-385-0x0000000078AA0000-0x0000000078B5F000-memory.dmp
memory/3192-380-0x0000000078AA0000-0x0000000078B5F000-memory.dmp
memory/3688-1462-0x0000023BEC8C0000-0x0000023BEC9C0000-memory.dmp
memory/3688-1482-0x0000023BEDC00000-0x0000023BEDD00000-memory.dmp
memory/3688-1521-0x0000023BFF270000-0x0000023BFF290000-memory.dmp
memory/3688-1478-0x0000023BEC700000-0x0000023BEC800000-memory.dmp
memory/3688-1517-0x0000023BEDC00000-0x0000023BEDD00000-memory.dmp
memory/3688-1520-0x0000023CFFB30000-0x0000023CFFB50000-memory.dmp
memory/3688-1612-0x0000023391C60000-0x0000023391D60000-memory.dmp
memory/3688-1598-0x00000233914A0000-0x00000233915A0000-memory.dmp