bb8236391219066d1329310f81d074b254f5da18d259c7924fba8147adfddacf

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\frida-9cca087887e66300112b96b4deb3ad9c\arm64\dbghelp.dll	DripLite By Brvjo.exe
File created	C:\Users\Admin\AppData\Local\Temp\frida-9cca087887e66300112b96b4deb3ad9c\x86_64\dbghelp.dll	DripLite By Brvjo.exe
File created	C:\Users\Admin\AppData\Local\Temp\frida-9cca087887e66300112b96b4deb3ad9c\x86\dbghelp.dll	DripLite By Brvjo.exe

Discovers running processes 1 TTPs 1 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

Process Discovery

T1057

pid	Process
1020	tasklist.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
5036	Drip.exe
5036	Drip.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\pa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\uk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\fil\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\th\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\as\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\mk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\offscreendocument_main.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\te\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\no\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ar\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\128.png	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\km\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\cs\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_4020_659034321\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_111_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\kk\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\nl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\am\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4020_704037901\offscreendocument.html	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	DripLite By Brvjo.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	DripLite By Brvjo.exe

System Network Connections Discovery 1 TTPs 3 IoCs

Attempt to get a listing of network connections.

System Network Connections Discovery

T1049

pid	Process
5532	netstat.exe
2132	netstat.exe
4448	netstat.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

System Time Discovery

T1124

pid	Process
4680	msedge.exe
3260	msedge.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
5532	netstat.exe
2132	netstat.exe
4448	netstat.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{F6E70FF3-4227-4AF7-A059-E30ED6750647}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{85842DCD-FC21-48F5-BFEA-EF1107149D98}	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5036	Drip.exe
5036	Drip.exe
5036	Drip.exe
5036	Drip.exe
5820	msedge.exe
5820	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3716	DripLite By Brvjo.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1020	tasklist.exe
Token: SeDebugPrivilege	5532	netstat.exe
Token: SeDebugPrivilege	2132	netstat.exe
Token: SeDebugPrivilege	4448	netstat.exe
Token: SeDebugPrivilege	3716	DripLite By Brvjo.exe
Token: SeDebugPrivilege	5036	Drip.exe

Suspicious use of FindShellTrayWindow 12 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of SendNotifyMessage 10 IoCs

pid	Process
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 3716	5196	DripLite By Brvjo.exe	86
PID 3716 wrote to memory of 1020	3716	DripLite By Brvjo.exe	91
PID 3716 wrote to memory of 5532	3716	DripLite By Brvjo.exe	93
PID 3716 wrote to memory of 2132	3716	DripLite By Brvjo.exe	95
PID 3716 wrote to memory of 4448	3716	DripLite By Brvjo.exe	97
PID 3716 wrote to memory of 5036	3716	DripLite By Brvjo.exe	99
PID 3716 wrote to memory of 5036	3716	DripLite By Brvjo.exe	99
PID 3716 wrote to memory of 4020	3716	DripLite By Brvjo.exe	107
PID 4020 wrote to memory of 3160	4020	msedge.exe	108
PID 4020 wrote to memory of 4680	4020	msedge.exe	109
PID 4020 wrote to memory of 4892	4020	msedge.exe	110
PID 4020 wrote to memory of 4892	4020	msedge.exe	110
PID 4020 wrote to memory of 4892	4020	msedge.exe	110
PID 4020 wrote to memory of 4168	4020	msedge.exe	112
PID 4020 wrote to memory of 4168	4020	msedge.exe	112
PID 4020 wrote to memory of 6112	4020	msedge.exe	113
PID 4020 wrote to memory of 6052	4020	msedge.exe	114
PID 4020 wrote to memory of 6112	4020	msedge.exe	113
PID 4020 wrote to memory of 6112	4020	msedge.exe	113
PID 4020 wrote to memory of 6052	4020	msedge.exe	114
PID 4020 wrote to memory of 6052	4020	msedge.exe	114
PID 4020 wrote to memory of 2396	4020	msedge.exe	117
PID 4020 wrote to memory of 2396	4020	msedge.exe	117
PID 4020 wrote to memory of 5436	4020	msedge.exe	118
PID 4020 wrote to memory of 5436	4020	msedge.exe	118
PID 4020 wrote to memory of 2908	4020	msedge.exe	120
PID 4020 wrote to memory of 1744	4020	msedge.exe	126
PID 4020 wrote to memory of 1744	4020	msedge.exe	126
PID 4020 wrote to memory of 5252	4020	msedge.exe	128
PID 4020 wrote to memory of 408	4020	msedge.exe	129
PID 4020 wrote to memory of 5744	4020	msedge.exe	130
PID 4020 wrote to memory of 5408	4020	msedge.exe	131
PID 4020 wrote to memory of 5408	4020	msedge.exe	131
PID 4020 wrote to memory of 1040	4020	msedge.exe	133
PID 4020 wrote to memory of 1040	4020	msedge.exe	133
PID 4020 wrote to memory of 2236	4020	msedge.exe	139
PID 4020 wrote to memory of 2236	4020	msedge.exe	139
PID 4020 wrote to memory of 2236	4020	msedge.exe	139
PID 4020 wrote to memory of 2444	4020	msedge.exe	140
PID 4020 wrote to memory of 2444	4020	msedge.exe	140
PID 4020 wrote to memory of 2444	4020	msedge.exe	140
PID 4020 wrote to memory of 1916	4020	msedge.exe	142
PID 4020 wrote to memory of 1916	4020	msedge.exe	142
PID 4020 wrote to memory of 1916	4020	msedge.exe	142
PID 4020 wrote to memory of 4760	4020	msedge.exe	143
PID 4020 wrote to memory of 4760	4020	msedge.exe	143
PID 4020 wrote to memory of 4760	4020	msedge.exe	143
PID 4020 wrote to memory of 5604	4020	msedge.exe	144
PID 4020 wrote to memory of 5604	4020	msedge.exe	144
PID 4020 wrote to memory of 4164	4020	msedge.exe	147
PID 4020 wrote to memory of 4164	4020	msedge.exe	147
PID 4020 wrote to memory of 5820	4020	msedge.exe	148
PID 5820 wrote to memory of 5432	5820	msedge.exe	149
PID 5820 wrote to memory of 3260	5820	msedge.exe	151
PID 5820 wrote to memory of 1960	5820	msedge.exe	152
PID 5820 wrote to memory of 1960	5820	msedge.exe	152
PID 5820 wrote to memory of 1960	5820	msedge.exe	152
PID 5820 wrote to memory of 2396	5820	msedge.exe	153
PID 5820 wrote to memory of 2396	5820	msedge.exe	153
PID 5820 wrote to memory of 3792	5820	msedge.exe	156
PID 5820 wrote to memory of 3264	5820	msedge.exe	158
PID 5820 wrote to memory of 4596	5820	msedge.exe	159
PID 5820 wrote to memory of 4916	5820	msedge.exe	160

C:\Users\Admin\AppData\Local\Temp\DripLite By Brvjo.exe
"C:\Users\Admin\AppData\Local\Temp\DripLite By Brvjo.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Users\Admin\AppData\Local\Temp\DripLite By Brvjo.exe
  "C:\Users\Admin\AppData\Local\Temp\DripLite By Brvjo.exe"
  2⤵
  - Loads dropped DLL
  - Writes a Windows system DLL name to a user directory
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3716
- - C:\Windows\SYSTEM32\tasklist.exe
    tasklist /FI "IMAGENAME eq Drip.exe" /FO CSV /NH
    3⤵
    - Discovers running processes
    - Suspicious use of AdjustPrivilegeToken
    PID:1020
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano -p tcp
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:5532
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano -p tcp
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:2132
- - C:\Windows\SYSTEM32\netstat.exe
    netstat -ano -p tcp
    3⤵
    - System Network Connections Discovery
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:4448
- - C:\Users\Admin\AppData\Local\Temp\MockReplayNice_data\Drip.exe
    "C:\Users\Admin\AppData\Local\Temp\MockReplayNice_data\Drip.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://127.0.0.1:8765/
    3⤵
    - Drops file in Program Files directory
    - Checks processor information in registry
    - Enumerates system info in registry
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c0,0x2c4,0x2c8,0x2bc,0x2d0,0x7ff895f1c188,0x7ff895f1c194,0x7ff895f1c1a0
      4⤵
      PID:3160
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,12503596761853086865,15232991217258846962,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
      4⤵
      System Time Discovery
      PID:4680
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,16935613859113659643,8739834575945629383,262144 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
      4⤵
      PID:4892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,6113038684659187462,3168463631644298566,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:4168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,1951108723829288031,18077846701985559806,2097152 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
      4⤵
      PID:6112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,14513271078939968432,12692502842543926699,2097152 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
      4⤵
      PID:6052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,9637003769709891784,15038362301145908899,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
      4⤵
      PID:2396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,2435197316930303811,4904481203713563414,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
      4⤵
      PID:5436
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,6886477391367774717,7936584069193660331,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:1332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,6886477391367774717,7936584069193660331,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,9714420373878952717,3620927708477575068,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
      4⤵
      PID:1744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,16713624940310689226,11354854713319967314,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
      4⤵
      PID:5252
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,7431035165913920493,13559534700765881087,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
      4⤵
      PID:408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,8028739262473987385,7775662426281134549,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
      4⤵
      PID:5744
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,16147389778636967717,7947480289770497830,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
      4⤵
      PID:5408
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12153919700962962892,10753463674614129162,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
      4⤵
      PID:1040
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2796,i,16678733665664003971,14651166605507867040,2097152 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
      4⤵
      PID:2236
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6360,i,5667368903265990270,3449091872009715914,2097152 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:1
      4⤵
      PID:2444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6428,i,4434431868640334659,174084397942101415,2097152 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
      4⤵
      PID:1916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2796,i,5520220495951824337,9253933156203910645,2097152 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
      4⤵
      PID:4760
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7054207206363947411,11771979254220120867,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
      4⤵
      PID:5604
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,6602897775183045679,13237361423499771698,524288 --field-trial-handle=2104,i,16295186428481301660,11707587167601755216,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
      4⤵
      Checks processor information in registry
      Enumerates system info in registry
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:5820
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x218,0x23c,0x240,0x210,0x260,0x7ff895f1c188,0x7ff895f1c194,0x7ff895f1c1a0
        5⤵
        
        PID:5432
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,4243919353083686349,11280717370432630713,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
        5⤵
        System Time Discovery
        
        PID:3260
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,15534606029265897752,14250647540302602914,262144 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
        5⤵
        
        PID:1960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,14485879883398136242,17418633964173735355,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
        5⤵
        
        PID:2396
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,7614487973677872220,10410600073749442193,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
        5⤵
        
        PID:3800
    - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,7614487973677872220,10410600073749442193,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
        5⤵
        
        PID:3792
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,425936085984668086,12757343466826201514,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
        5⤵
        
        PID:3264
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,1795171472981058806,4554659429984384943,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:8
        5⤵
        
        PID:4596
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,6998508154791281034,8962973447712486364,524288 --field-trial-handle=2528,i,8387633357840222991,8800725101253178492,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
        5⤵
        
        PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4768

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Hijack Execution Flow

T1574

DLL Search Order Hijacking

Privilege Escalation

Hijack Execution Flow

T1574

DLL Search Order Hijacking

Defense Evasion

Debugger Evasion

T1622

Hijack Execution Flow

T1574

DLL Search Order Hijacking

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Browser Information Discovery

Debugger Evasion

Process Discovery

Query Registry

System Information Discovery