Analysis
- user interaction
yes - max time kernel
1049s - max time network
1040s - platform
windows11-21h2_x64 - resource
win11-20260911-en - resource tags
- submitted
26/10/2026, 16:20
General
- Target victimrat.exe
- Size 7.1MB
- Sample261026-ts4rdsf14r
- SHA256 f4fe3fd169c3aa097376ccb401ce81e5c32084d24dd02b00790346b04ef7c8a6
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Looks up external IP address via web service 1 TTPs 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in Windows directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies registry class 43 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of FindShellTrayWindow 60 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\victimrat.exe"C:\Users\Admin\AppData\Local\Temp\victimrat.exe"1⤵
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /Create /F /SC ONLOGON /RL LIMITED /TN MicrosoftEdgeCoreUpdate /TR C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exe2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exe2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exeC:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exe --bench-watchdog 42003⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\MicrosoftEdgeCoreUpdate.exe"1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e0,0x2e4,0x2e8,0x2dc,0x2f0,0x7ffcedd5c188,0x7ffcedd5c194,0x7ffcedd5c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,11023101378362444348,1293047414219505717,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,17412887722776411876,2473939106133686870,262144 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,9352366876549789664,116699712957162617,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,14154789712101953761,2575404206207282994,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,1584825770057391690,7393446429301333550,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,6212512064918344004,6373850451971691785,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,16978835029789627413,9919710881098546465,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,5095814783686523396,12084333256391359390,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,10196068208240444622,2202235823942977613,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12416735063957104460,178740984290967625,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,722872336896244920,15832844908584033472,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,3361825216789870075,7182618199052036982,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,9837838599722899989,15588609078979911741,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4586887831687387656,12249600564959187612,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,13699739206545396860,11173511268794924140,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11443⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,4586887831687387656,12249600564959187612,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,10612124567363309413,15228132926902629822,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,5891187761756438839,14881624593587694436,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,5930396900864743052,1867403572262606522,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,8692240599836729761,1397735084245397256,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,5031612817890251290,8838150732831338798,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,10329897657473314129,7201470335622511262,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,12255659537419818640,9565495979325905313,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,11479877613954364658,7681477091716696109,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,4592149791295545197,16367281947208396433,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,15841842377276768629,14790538089840301895,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6896,i,2006653013268576722,15878175402441017583,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6900,i,13334148651010687795,3489598486865069233,2097152 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,18112712524088228176,14094896776056561313,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,15849462602480828192,15388227302687917537,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,6876940581609552214,9025779750327669409,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6956,i,9729988291344691966,4695221438940039573,262144 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,15500102605064939748,13670948396977083663,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,13195457019110900435,9127132541157502212,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,14104437576912249300,14062595635908222029,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10928625283935706940,401700731014009499,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,5672344863467666750,8442187590151577787,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7116,i,13525762662131827227,2589652878012110134,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,289545197986430615,11602705160332939493,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1136,i,8677013656265657617,1059269187706741693,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,10434447038815593527,2410269039151593483,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3876 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,5187107424337200161,15589124742641281129,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,1645972910233587563,198390785362967144,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,18090678923833689752,14504779978128358443,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3220,i,10214428309798703834,14125668251989409731,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,3072155270169814022,786934835192672371,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,9733183120506482533,1583451590566363563,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,5391483767164350533,4219906905613224058,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,4488048334531208971,10155250047793099769,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,11915888939002422018,13812967822649402919,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,18089384783779736864,13168062912824126450,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,15778731113250240526,10199364032840623234,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,6403243747299216284,10023745524512031332,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,17702671582098397641,13076516769330291065,524288 --field-trial-handle=2212,i,15294389772977396434,1940336339130873306,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
3Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
06b971b2-2837-463c-9797-5b5e5dd30987.tmp
08b26fae-6a68-4c56-ab5c-7f49fd1960c9.tmp
312b004b-9571-4754-9381-23b909106460.tmp
9c3a058f-8c3c-44cc-9496-5a0d06201cb1.tmp
9fbbd1b7-98f4-49f9-b530-cd30ab5c175f.tmp
manifest.json
manifest.json
manifest.json
CrashpadMetrics-active.pma
settings.dat
settings.dat
3cd8f6dc-7464-4ffa-80cb-8912380bf3f9.tmp
4998f3d4-dd4c-4d82-a85e-a06d5cd3a25d.tmp
58d1e003-7ec1-4343-8ceb-64177f966168.tmp
97d88947-f37c-449d-83f0-8920f07bee05.tmp
LOG
LOG.old
LOG.old
f_000048
f_00004a
f_00004b
f_00004c
f_000050
f_000051
f_000052
f_00006d
f_000073
f_000074
f_000075
f_000076
f_000077
temp-index
the-real-index
the-real-index
58a27bfc-ec2a-4fc2-a830-b869bf5c77fe.tmp
dasherSettingSchema.json
15f33f76-589d-49af-ab7b-e6202877bd60.tmp
2f7686d1-a3f7-4378-a3ca-a39fb3fcafc1.tmp
8487d1c2-499f-468b-bf5e-300dcbbc86ae.tmp
8c724d4f-835b-4fcd-a0c8-3dd52b62b3fc.tmp
914a126d-4679-4c98-9d42-e7a42ac1005a.tmp
Sdch Dictionaries
a6be975c-b203-4a7a-bb87-3efc99a7f4fa.tmp
b497484a-370d-4f80-9185-4ecaadc244be.tmp
temp-index
the-real-index
temp-index
index.txt.tmp
index.txt.tmp
index.txt.tmp
index.txt.tmp
temp-index
sync_diagnostic.log
ac1e5e16-523a-43eb-afa9-83e5f53f0239.tmp
bfc78f50-a168-48bd-94f8-a22dde403ff1.tmp
dbc089be-0f48-4ff7-8db9-52d382fe6fc7.tmp
e566c74f-b830-4788-b9ef-142e0ba524d1.tmp
fa0e583b-2e42-4a8c-9ca5-b94bc14b03ea.tmp
domain_actions.dll
manifest.json
manifest.json
d85e2543-43fe-40bd-a09a-0c870b1393eb.tmp
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
Other
manifest.json
manifest.json
manifest.json
manifest.json
manifest.json
well_known_domains.dll
manifest.json
manifest.json
af6e32ef-f4b1-4e91-adca-913c014c465b.tmp
08a985e7-f3e1-45ac-a3ce-1c785ff6293a.tmp
1322556b-ef59-450b-a8f1-b994079ac56d.tmp
1e4384b5-09e0-4dc8-8cf5-eae41b51dc62.tmp
2038c48e-57eb-41ed-a329-4ea6ec4d989d.tmp
2ea7a817-6512-4c78-8891-e4ac535a93d4.tmp
45e7eb8c-488c-4881-bcb8-21d0f55a1a15.tmp
569e1fc5-2fd4-4c27-becf-adc4e85aada9.tmp
5de3f09b-ff24-425b-8679-fa92a44236b0.tmp
82da0af4-de4f-4519-ab19-eed7e10cb025.tmp
96cfff1f-3f28-49e5-9645-970e8d6cef93.tmp
a097ca29-2a81-406e-bba9-ac5d5b6dd439.tmp
bb8901d2-aaf5-49f1-95ba-f8bec1ea10e4.tmp
ccb287fa-2e5b-4fde-80aa-71e8c1553fa9.tmp
d3141d9f-7350-4190-9889-beae7900e9e2.tmp
d805ea84-1848-47a0-a7e3-2aca6b228b05.tmp
e366ebf5-9df2-4f85-aee9-39ff058d3dd6.tmp
edc256b3-519d-433b-ada8-b1b51386a59e.tmp
eff67228-e8e0-4054-b7c4-51f157fde93d.tmp
f9bf25a8-79f0-471f-8c6e-dbb1c306e919.tmp
84b7e373-c19a-4a4a-a81d-47eab2803ac9.tmp
fb478d56-a936-4e9c-af0c-0b6deada4066.tmp
ff5ffbb8-6fbd-443e-aadc-7607703d2769.tmp
MicrosoftEdgeCoreUpdate.exe
9205533c-ea6d-49a6-9cfe-b3d0335ed2ea.tmp
9693779a-3318-434a-a5c4-f75603228201.tmp
content.js
a0e83911-214b-4d13-ac76-5b29f896c55c.tmp
messages.json
LICENSE
verified_contents.json
keys.json
data.txt
typosquatting_list.pb
deny_domains.list
deny_etld1_domains.list
deny_full_domains.list
arbitration_metadata.txt
crs.pb
ct_config.pb
kp_pinslist.pb
nav_config.json
protocols.json
llm_user_input_extractor_config.json
office_endpoints_list.json
smart_switch_list.json
Advertising
Analytics
CompatExceptions
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
TransparentAdvertisers
Advertising
Analytics
Content
Cryptomining
Entities
Fingerprinting
LICENSE
Social
Staging
verified_contents.json
sets.json
autofill_bypass_cache_forms.json
edge_autofill_global_block_list.json
regex_patterns.json
v1FieldTypes.json
crl-set
automation.js
classification.js
extraction.js
travel-facilitated-booking-bing.js
travel-facilitated-booking-kayak.js
english_wikipedia.txt
female_names.txt
male_names.txt
model.markov
passwords.txt
ranked_dicts
surnames.txt
test.txt
us_tv_and_film.txt
verified_contents.json
safety_tips.pb
typosquatting_list.pb
memory/3476-1575-0x000001BC58090000-0x000001BC58190000-memory.dmp
memory/3476-1601-0x000001BC692C0000-0x000001BC692E0000-memory.dmp
memory/3476-1602-0x000001BC69220000-0x000001BC69240000-memory.dmp
memory/3476-1672-0x000001BD7DAC0000-0x000001BD7DBC0000-memory.dmp
memory/3476-1566-0x000001BC58250000-0x000001BC58350000-memory.dmp
memory/3476-1583-0x000001BC79F30000-0x000001BC7A030000-memory.dmp
memory/3476-1582-0x000001BC7A050000-0x000001BC7A150000-memory.dmp