Analysis
- user interaction
yes - max time kernel
599s - max time network
599s - platform
windows11-21h2_x64 - resource
win11-20260911-fr - resource tags
- submitted
24/10/2026, 04:57
General
- Target asd.txt
- Size 37B
- Sample261024-flgrdsec66
- SHA256 627ce78d9664e588be031f36a8aae1ee0746b7835a8d645d8026352ded0d7fe8
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Downloads MZ/PE file 2 IoCs
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 62 IoCs
- Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies registry class 45 IoCs
- NTFS ADS 2 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\asd.txt1⤵
- Executes a command shell one-liner
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\asd.txt2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f4,0x7ffc90b2c188,0x7ffc90b2c194,0x7ffc90b2c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,2122575607681704233,13401209037831602422,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,14558542534079268388,11265801880177081223,262144 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,9833145134402036837,8107713987412419309,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,570778282459224457,3660747355191691975,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,7193157512782984713,1597299469007880394,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,306951399963823013,741031945020248508,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,4289831679315243019,8783112121428405826,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4464,i,11501625435533218728,8787112813913705533,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4472,i,11364580715136986740,5056264641680357267,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,14565974910797244697,318856672371725765,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,2022710808421917327,6339749663384414888,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,17880834938152913177,13763994329145127584,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,15426299927239106803,2104149977788772465,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,18110479108141527420,16852294890864473346,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11323⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6660540093954677022,15855533785385211994,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,6660540093954677022,15855533785385211994,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,12493023235941003649,2675766803018354052,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,2352636770044395611,747746735271677813,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,14832183648301639757,13297501879845880667,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,1241773785777769287,1789420447336987240,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,12416376405919706681,17050351991521265294,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6756,i,7072310609954828191,1579434040867935905,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,13363063841626465488,13083912188549896968,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=728,i,17599742270605669629,7367097200449779117,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,7570321583403708717,15224866328707422367,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,7042492276320529644,8681001018257291832,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,3992878263767295989,9752422007896764031,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5812,i,814870397420795942,7772217122692985857,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,8158530076074670670,9812391242987772220,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=4916,i,11293602789340937361,5537857459243945750,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,2734955022561100642,3093344486785733971,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:142⤵
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,2083480674701292818,8240841243485808434,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=880,i,9043241611307166524,16245518378317027420,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,9051693782246197504,15051907530349339500,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3616,i,7692011843729782551,256008665730451800,262144 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=3716,i,11625855984606878509,5457623507768549875,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2953683049692212983,11973960686291501128,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7960,i,3488680425249464639,16851474270583714304,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7996,i,3553781954656502741,7489722312306216396,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,13585171473920893462,9652592871617366516,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,9329161372397132895,16692540568026454216,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=3320 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8036,i,240520478365901065,6234124298693011820,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=8136,i,13260094078624375187,4368781090712619974,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=5996,i,2205188061572951871,14862348817710859743,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,15473948895100267143,17536084982983780572,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5828,i,7297841395702939293,1380440915372163976,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=8076 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7956,i,14952028797936836922,12604639616812208167,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=7092,i,4655537601301413651,7559891508635295661,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8088,i,12960985766363610177,15631991536426167814,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=5780,i,9109240888873318370,12041891177847099902,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,16459136691648363765,17634248363631752293,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7756 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=8100,i,9706291126160569672,12648756643956591968,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,11689663295177039566,9835881328858501106,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7232 /prefetch:142⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,16297575384538127853,17837575319794957502,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7508,i,16297575384538127853,17837575319794957502,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=6060,i,6673237038138627438,504171790493520633,2097152 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,14364646665675818337,9826910600475364719,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8324,i,523821150416798060,11092088310477347517,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8316,i,17776622992178939996,8526229192993831012,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\DiscordSetup (1).exe"C:\Users\Admin\Downloads\DiscordSetup (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe"C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,4689245696499655080,6646182300852583120,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9056,i,3926361485270434268,18274832323593375731,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=8492 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8908,i,10870599390658554765,389236744910035300,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=8916 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,16139624930557588933,15057270775112337605,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,17504155012587659608,7312393341605829048,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=9136 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8384,i,4288507236582126079,1330017148072404664,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,10511962346024583049,7268559238743810520,524288 --field-trial-handle=2216,i,9717202608305217938,1789010074058508300,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1Replay Monitor
Loading Replay Monitor...
Downloads
035af3de-3173-4c73-a590-7f4390df5791.tmp
233b9304-ae5a-4efa-8b99-f51377b2181a.tmp
3fe93dde-590a-459f-b32a-bbfb15b50dda.tmp
6ae5df7a-e057-46b1-9ecc-c8521b6577e6.tmp
73708af0-30c5-41ac-9ff5-0e40bd676ccc.tmp
78093227-0121-42a8-8e45-f7d80df8daa8.tmp
7cfd0e78-5146-4506-bf62-679da5f22f09.tmp
manifest.json
manifest.json
manifest.json
settings.dat
settings.dat
07a65b54-38ee-4823-af92-80903a6700d9.tmp
0cef10db-ab44-413a-8fd8-780e3099fbd8.tmp
3f518f10-a737-4f30-9965-a0f308e61f0e.tmp
49345c70-d64c-4879-b5e7-0e81d3d2c9f6.tmp
4a31b46b-819a-47ee-8cf8-3ff0f7786a21.tmp
4f44260e-5323-49c5-815b-23fe94bc891d.tmp
5eac79f6-d811-4305-8ef1-bfff4bb875d3.tmp
6882f113-1d7c-4036-9c27-f757affc3240.tmp
LOG
LOG
f_00006e
f_000070
f_000071
f_000072
f_000076
f_000077
f_000078
f_000084
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008d
f_00008e
f_00008f
f_000090
f_000092
f_000093
f_000094
f_000096
f_00009a
f_00009b
f_00009d
f_00009f
f_0000a7
f_0000a9
f_0000b9
f_0000ba
f_0000c2
f_0000c3
f_0000c4
f_0000c5
f_0000c6
f_000103
temp-index
temp-index
temp-index
temp-index
the-real-index
the-real-index
19abeb62-954c-45bd-a835-c161be03943f.tmp
dasherSettingSchema.json
09e04027-f601-4f5f-b33a-5cdbeab1098a.tmp
2141cbd4-f2ef-4110-80fd-9ca37599b356.tmp
3f114cc0-741e-448a-b9a9-ab5c9286fad2.tmp
41749713-0913-40ae-8cd7-57870b1e7082.tmp
41f19841-f92b-453c-a7b7-64ff5520c24b.tmp
502b675a-51a5-47f4-82fc-99fe28ccd202.tmp
Sdch Dictionaries
afb4751f-5d16-4356-ac4c-2e990699a7ff.tmp
c20c7bac-6ec9-4817-bc12-95919bd9dd37.tmp
Preferences
Preferences
temp-index
the-real-index
temp-index
the-real-index
the-real-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
the-real-index
index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
temp-index
the-real-index
sync_diagnostic.log
the-real-index
the-real-index
index.txt
index.txt.tmp
index.txt.tmp
b164302c-7985-4c99-a417-e21397d70eeb.tmp
manifest.json
448712bc-0352-4d22-b05d-779ab28d2cd0.tmp
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
RevisitationBloomfilter
manifest.json
manifest.json
manifest.json
manifest.json
a4f2c36f-dab2-4dad-ac4b-40f838c8ed3b.tmp
b0cce27b-6d11-4faa-a69a-45075e8afef8.tmp
bcddb2ea-067a-40dc-b7e5-bb9c7cf48f62.tmp
32e9416a-61d3-4368-87e5-7ff12dab47ae.tmp
397d1480-406c-4478-bf99-45ed8dde68d5.tmp
3b97ce4d-b778-4a35-a8cc-818696b173b6.tmp
66586781-834e-4d8f-a797-17838af630e7.tmp
66c34d8b-779d-4143-87fe-1a80b76ab714.tmp
82b20690-57c1-444c-96b2-bf54eb278fff.tmp
8654d5b6-c91c-4812-816f-9b1b8e0a9e86.tmp
9e18905d-d943-4037-a7ca-52d801fa0d37.tmp
a6abf684-f935-479f-aa37-be9c198728e8.tmp
b17b4741-e730-4095-bafa-8a4f4a8afada.tmp
ba2f64f0-d7b8-4e1c-9e47-5ac68075dff5.tmp
cf9056cf-a683-4282-be26-78108630a829.tmp
d8c30162-57a8-4201-83e3-bd25cbe4a640.tmp
20c8f037-9dd9-4d6e-8ee5-f8cd32d65e52.tmp
RELEASES
Update.exe
a1e733b2-5598-42c1-8f26-cff5a929600e.tmp
cebfc008-018d-4afc-89c6-358352bdb4cc.tmp
messages.json
content.js
b2ebcbf0-128e-4dd1-b463-e2cf2b5b6ee2.tmp
default.dic
DiscordSetup (1).exe.crdownload
DiscordSetup.exe:Zone.Identifier
bc99e53b-f939-473b-9375-6a3444299720.tmp
volume.PNF
protocols.json
crl-set
domain_actions.dll
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
nav_config.json
LICENSE
verified_contents.json
keys.json
arbitration_metadata.txt
automation.js
classification.js
extraction.js
travel-facilitated-booking-bing.js
travel-facilitated-booking-kayak.js
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
well_known_domains.dll
verified_contents.json
sets.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
regex_patterns.json
v1FieldTypes.json
memory/5072-3728-0x0000024FD06E0000-0x0000024FD07E0000-memory.dmp
memory/5072-3778-0x00000250F4CC0000-0x00000250F4DC0000-memory.dmp
memory/5072-3777-0x00000250F4CC0000-0x00000250F4DC0000-memory.dmp
memory/5072-3763-0x0000024FF29C0000-0x0000024FF29E0000-memory.dmp
memory/5072-3762-0x0000024FF2D60000-0x0000024FF2D80000-memory.dmp
memory/5072-3727-0x0000024FE1600000-0x0000024FE1700000-memory.dmp
memory/5072-3744-0x0000024FD0530000-0x0000024FD0630000-memory.dmp
memory/5072-3750-0x0000024FF20D0000-0x0000024FF21D0000-memory.dmp
memory/5072-3749-0x0000024FF21F0000-0x0000024FF22F0000-memory.dmp
memory/6004-3663-0x00000000078A0000-0x00000000078D8000-memory.dmp
memory/6004-3664-0x0000000007870000-0x000000000787E000-memory.dmp
memory/6004-3660-0x0000000007900000-0x0000000007A02000-memory.dmp
memory/6004-3641-0x00000000076A0000-0x00000000076A8000-memory.dmp
memory/6004-3494-0x0000000000080000-0x000000000020A000-memory.dmp