Analysis
- max time kernel
659s - max time network
664s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
- submitted
09/04/2024, 16:07
General
- Target https://www.mediafire.com/file/lqlncwwnvq7n1rq/WaveTrial.rar/file
- Sample240409-tk3t5abg64
Score
9/10
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Sets file execution options in registry 2 TTPs 2 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 6 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 33 IoCs
- Loads dropped DLL 64 IoCs
- Registers COM server for autorun 1 TTPs 33 IoCs
- Themida packer 6 IoCs
Detects Themida, an advanced Windows software protection system.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
- Checks system information in the registry 2 TTPs 14 IoCs
System information is often read in order to detect sandboxing environments.
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 19 IoCs
- Drops file in Program Files directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 43 IoCs
- Modifies registry class 64 IoCs
- Opens file in notepad (likely ransom note) 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 26 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/lqlncwwnvq7n1rq/WaveTrial.rar/file1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc961d9758,0x7ffc961d9768,0x7ffc961d97782⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:22⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5080 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5700 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3124 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5040 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5968 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=6268 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=6244 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6420 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6812 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6804 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=7136 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=7284 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=7288 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=7572 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=7600 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=8464 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=8448 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=8748 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=8984 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=9112 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=9392 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=9400 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=9432 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=9440 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=9448 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=9592 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=9604 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --mojo-platform-channel-handle=9620 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=9636 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=9652 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --mojo-platform-channel-handle=9668 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=9684 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=9708 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=11268 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=9844 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=11428 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=11444 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=11452 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=11460 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=11468 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=11728 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=11876 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=11884 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=12532 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=12776 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=12772 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=14356 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=14796 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=10652 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --mojo-platform-channel-handle=11552 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --mojo-platform-channel-handle=14492 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --mojo-platform-channel-handle=10004 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --mojo-platform-channel-handle=14076 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --mojo-platform-channel-handle=9676 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --mojo-platform-channel-handle=10396 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4732 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=11304 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\7-Zip\7zFM.exe"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\WaveTrial.rar"2⤵
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --mojo-platform-channel-handle=13372 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --mojo-platform-channel-handle=10764 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=14724 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=11552 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --mojo-platform-channel-handle=4680 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --mojo-platform-channel-handle=11408 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --mojo-platform-channel-handle=9404 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=12884 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11232 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9780 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=11124 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Bloxstrap-v2.5.4.exe"C:\Users\Admin\Downloads\Bloxstrap-v2.5.4.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-f573c8cc796e4c97\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-f573c8cc796e4c97\WebView2RuntimeInstaller\MicrosoftEdgeWebview2Setup.exe" /silent /install3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Temp\EUC1C1.tmp\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\Temp\EUC1C1.tmp\MicrosoftEdgeUpdate.exe" /silent /install "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers"4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regsvc5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /regserver5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\1.3.171.39\MicrosoftEdgeUpdateComRegisterShell64.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUM5MEE0RTItM0FFQy00NzcyLUI2M0YtN0UxQkFGQUFDQTQxfSIgdXNlcmlkPSJ7M0QzNUE5QjEtRDk0Ri00MzE0LTgyODQtMDhDN0U0MkNGMTQwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9IntENDhFQ0I2Qy00QTAyLTQ5MjctODc5Ni1FMDkzNkZDRTU1NjJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzQzRGRTAwLUVGRDUtNDAzQi05NTY5LTM5OEEyMEYxQkE0QX0iIHZlcnNpb249IjEuMy4xODUuMTciIG5leHR2ZXJzaW9uPSIxLjMuMTcxLjM5IiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIj48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTc3MDE4MTMyIiBpbnN0YWxsX3RpbWVfbXM9IjEyOTQiLz48L2FwcD48L3JlcXVlc3Q-5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /handoff "appguid={F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}&appname=Microsoft%20Edge%20Webview2%20Runtime&needsadmin=prefers" /installsource otherinstallcmd /sessionid "{1C90A4E2-3AEC-4772-B63F-7E1BAFAACA41}" /silent5⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-f573c8cc796e4c97\RobloxPlayerBeta.exe"C:\Users\Admin\AppData\Local\Bloxstrap\Versions\version-f573c8cc796e4c97\RobloxPlayerBeta.exe" --app -channel production3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
-
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --mojo-platform-channel-handle=4832 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --mojo-platform-channel-handle=13600 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4776 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=11260 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --mojo-platform-channel-handle=10104 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --mojo-platform-channel-handle=11668 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --mojo-platform-channel-handle=4636 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --mojo-platform-channel-handle=9464 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:12⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=2056,i,3817962429100657510,8621378918535458574,131072 /prefetch:82⤵
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x514 0x2fc1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\Wave.exe"C:\Users\Admin\Downloads\Wave.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\Downloads\Injector.exe"C:\Users\Admin\Downloads\Injector.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Downloads\dist\shared\wave-luau.exe"C:\Users\Admin\Downloads\dist\shared\wave-luau.exe"1⤵
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dist\shared\bin\wave-luau.exe"C:\Users\Admin\Downloads\dist\shared\bin\wave-luau.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\dist\server\index.js2⤵
- Opens file in notepad (likely ransom note)
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\dist\server\index.js"1⤵
-
C:\Users\Admin\Downloads\dist\node.exe"C:\Users\Admin\Downloads\dist\node.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
- Modifies data under HKEY_USERS
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUM5MEE0RTItM0FFQy00NzcyLUI2M0YtN0UxQkFGQUFDQTQxfSIgdXNlcmlkPSJ7M0QzNUE5QjEtRDk0Ri00MzE0LTgyODQtMDhDN0U0MkNGMTQwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9Ins2MjY4REQ3Mi03NUFBLTQwNTktQjZCMS04NDZFRTVEREVCRDZ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O3I0NTJ0MStrMlRncS9IWHpqdkZOQlJob3BCV1I5c2JqWHhxZVVESDl1WDA9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEwNi4wLjUyNDkuMTE5IiBuZXh0dmVyc2lvbj0iMTA2LjAuNTI0OS4xMTkiIGxhbmc9ImVuIiBicmFuZD0iR0dMUyIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSI1IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MTk1MjQ4MTExIi8-PC9hcHA-PC9yZXF1ZXN0Pg2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\MicrosoftEdge_X64_123.0.2420.81.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level2⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\EDGEMITMP_42D97.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\EDGEMITMP_42D97.tmp\setup.exe" --install-archive="C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\MicrosoftEdge_X64_123.0.2420.81.exe" --msedgewebview --verbose-logging --do-not-launch-msedge --system-level3⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\EDGEMITMP_42D97.tmp\setup.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\EDGEMITMP_42D97.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\MsEdgeCrashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=123.0.6312.106 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeUpdate\Install\{D88BE36F-3597-4436-9B93-92653AB6F171}\EDGEMITMP_42D97.tmp\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=123.0.2420.81 --initial-client-data=0x22c,0x230,0x234,0x208,0x238,0x7ff7a00dbaf8,0x7ff7a00dbb04,0x7ff7a00dbb104⤵
- Executes dropped EXE
-
-
-
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xNzEuMzkiIHNoZWxsX3ZlcnNpb249IjEuMy4xNzEuMzkiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7MUM5MEE0RTItM0FFQy00NzcyLUI2M0YtN0UxQkFGQUFDQTQxfSIgdXNlcmlkPSJ7M0QzNUE5QjEtRDk0Ri00MzE0LTgyODQtMDhDN0U0MkNGMTQwfSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiByZXF1ZXN0aWQ9InsxNkE4ODUyQS1GQjZBLTRCNzQtQTlDMi03M0E1MTk1NTg3NTB9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IGxvZ2ljYWxfY3B1cz0iOCIgcGh5c21lbW9yeT0iOCIgZGlza190eXBlPSIyIiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIgcHJvZHVjdF90eXBlPSI0OCIgaXNfd2lwPSIwIi8-PG9lbSBwcm9kdWN0X21hbnVmYWN0dXJlcj0iREFEWSIgcHJvZHVjdF9uYW1lPSJTdGFuZGFyZCBQQyAoUTM1ICsgSUNIOSwgMjAwOSkiLz48ZXhwIGV0YWc9IiZxdW90O1ZQUW9QMUYrZnExNXdSemgxa1BMNFBNcFdoOE9STUI1aXp2ck9DL2NoalE9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0ie0YzMDE3MjI2LUZFMkEtNDI5NS04QkRGLTAwQzNBOUE3RTRDNX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEyMy4wLjI0MjAuODEiIGxhbmc9IiIgYnJhbmQ9IiIgY2xpZW50PSIiIGV4cGVyaW1lbnRzPSJjb25zZW50PWZhbHNlIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48dXBkYXRlY2hlY2svPjxldmVudCBldmVudHR5cGU9IjkiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9IjgyMTMzMTg2NTEiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI1IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4MjEzNzg4NjI3IiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgc3lzdGVtX3VwdGltZV90aWNrcz0iODUxOTUxODgxOSIgc291cmNlX3VybF9pbmRleD0iMCIgZG9uZV9iZWZvcmVfb29iZV9jb21wbGV0ZT0iMCIgZG93bmxvYWRlcj0iYml0cyIgdXJsPSJodHRwOi8vbXNlZGdlLmYudGx1LmRsLmRlbGl2ZXJ5Lm1wLm1pY3Jvc29mdC5jb20vZmlsZXN0cmVhbWluZ3NlcnZpY2UvZmlsZXMvN2EwYTBiZDYtYjljOS00YzU2LTk2NDktZTllOWMyMmZiZTQzP1AxPTE3MTMyODQwNzYmYW1wO1AyPTQwNCZhbXA7UDM9MiZhbXA7UDQ9VUwlMmZnTzBwT2kzM05BakJCeGExSTFQNURwU05vZVkyWENQMEZLVGolMmI1TWlNWUpCQnBKYjVHMzNIYzZFaElyQ2w5d3hleFd3ZkV4SDZFa1lVMXpBNW9RJTNkJTNkIiBzZXJ2ZXJfaXBfaGludD0iIiBjZG5fY2lkPSItMSIgY2RuX2NjYz0iIiBjZG5fbXNlZGdlX3JlZj0iIiBjZG5fYXp1cmVfcmVmX29yaWdpbl9zaGllbGQ9IiIgY2RuX2NhY2hlPSIiIGNkbl9wM3A9IiIgZG93bmxvYWRlZD0iMTcyMDg2NzQ0IiB0b3RhbD0iMTcyMDg2NzQ0IiBkb3dubG9hZF90aW1lX21zPSIyMTU5OCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIHN5c3RlbV91cHRpbWVfdGlja3M9Ijg1MTk3MzgzOTAiIHNvdXJjZV91cmxfaW5kZXg9IjAiIGRvbmVfYmVmb3JlX29vYmVfY29tcGxldGU9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI4NTQyNDM4ODQyIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzU3IiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI5MjE1MjM4Mjg3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiBkb25lX2JlZm9yZV9vb2JlX2NvbXBsZXRlPSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iOTQ4IiBkb3dubG9hZF90aW1lX21zPSIzMDU3MiIgZG93bmxvYWRlZD0iMTcyMDg2NzQ0IiB0b3RhbD0iMTcyMDg2NzQ0IiBwYWNrYWdlX2NhY2hlX3Jlc3VsdD0iMCIgaW5zdGFsbF90aW1lX21zPSI2NzI0MyIvPjwvYXBwPjwvcmVxdWVzdD42⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks system information in the registry
-
-
C:\Users\Admin\Downloads\Wave.exe"C:\Users\Admin\Downloads\Wave.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Users\Admin\Downloads\debug.log" --field-trial-handle=2024,i,16397895044961550034,8367995378749705661,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2 --host-process-id=61562⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\dist\node.exe"C:\Users\Admin\Downloads\dist\node.exe" server2⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\Downloads\dist\shared\bin\wave-luau.exeC:\Users\Admin\Downloads\dist\shared\bin\wave-luau.exe lsp --definitions=C:\Users\Admin\Downloads\dist\shared\bin\globalTypes.d.luau --definitions=C:\Users\Admin\Downloads\dist\shared\bin\wave.d.luau --docs=C:\Users\Admin\Downloads\dist\shared\bin\en-us.json3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\debug.log" --field-trial-handle=2748,i,16397895044961550034,8367995378749705661,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3 --host-process-id=61562⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\debug.log" --field-trial-handle=3836,i,16397895044961550034,8367995378749705661,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8 --host-process-id=61562⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\Downloads\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3912,i,16397895044961550034,8367995378749705661,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3908 --host-process-id=6156 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --no-sandbox --log-file="C:\Users\Admin\Downloads\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3928,i,16397895044961550034,8367995378749705661,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=3920 --host-process-id=6156 /prefetch:12⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe"C:\Users\Admin\Downloads\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\CEF\User Data" --cefsharpexitsub --log-file="C:\Users\Admin\Downloads\debug.log" --field-trial-handle=4996,i,16397895044961550034,8367995378749705661,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8 --host-process-id=61562⤵
- Executes dropped EXE
-
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Checks system information in the registry
-
C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /svc1⤵
- Executes dropped EXE
- Checks system information in the registry
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
setup.exe
MicrosoftEdge_X64_123.0.2420.81.exe
MicrosoftEdgeUpdate.exe
settings.dat
LICENSE
manifest.json
MicrosoftEdgeUpdate.log
ClientAppSettings.json
shimmer_lightTheme.png
buttonFill.png
normaldetail.dds
zh-hans.json
zh-tw.json
ouch.ogg
IBeamCursor.png
Clear.png
valueBoxRoundedRectangle.png
checkbox_square.png
Thumbstick1.png
Thumbstick2.png
LocalPrefs.json
LocalPrefs.json
LocalPrefs.json~RFe607f36.TMP
settings.dat
f_00001a
f_00002c
f_000033
f_000050
2f06b06496e65fc8_0
7ece01b0cb477166_0
cb45fc9a639f0741_0
f14f80be26c6083b_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
index.txt
index.txt~RFe5bc550.TMP
Local State
Local State
Local State
Local State
Module Info Cache
Module Info Cache~RFe59b1f1.TMP
persisted_first_party_sets.json
Bloxstrap-v2.5.4.exe
Wave.exe
WaveTrial.rar
settings.json
index-daab.js
memory/1492-9133-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/1492-9193-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/1492-9134-0x000001A525740000-0x000001A525750000-memory.dmp
memory/1492-9132-0x000001A57F850000-0x000001A57F96E000-memory.dmp
memory/1492-9131-0x000001A57DAD0000-0x000001A57DAD6000-memory.dmp
memory/2068-9145-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/2068-9249-0x0000024AA5220000-0x0000024AA5230000-memory.dmp
memory/2068-9248-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/2068-9147-0x0000024AA5220000-0x0000024AA5230000-memory.dmp
memory/2260-9188-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/2260-9194-0x000001F98D410000-0x000001F98D420000-memory.dmp
memory/4248-9254-0x0000025C0D300000-0x0000025C0D310000-memory.dmp
memory/4248-9252-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/4248-9185-0x0000025C0D300000-0x0000025C0D310000-memory.dmp
memory/4248-9184-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/5276-1748-0x00007FFCA4AD0000-0x00007FFCA4FCE000-memory.dmp
memory/5276-9129-0x00007FFCA4AD0000-0x00007FFCA4FCE000-memory.dmp
memory/5276-2322-0x00007FFCA4AD0000-0x00007FFCA4FCE000-memory.dmp
memory/6156-9163-0x000001B4E2240000-0x000001B4E2266000-memory.dmp
memory/6156-9169-0x000001B4E5020000-0x000001B4E502E000-memory.dmp
memory/6156-9166-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/6156-9165-0x000001B4E50D0000-0x000001B4E50D8000-memory.dmp
memory/6156-9164-0x000001B4E26B0000-0x000001B4E26E2000-memory.dmp
memory/6156-9109-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/6156-9162-0x000001B4E21C0000-0x000001B4E21CA000-memory.dmp
memory/6156-9161-0x000001B4E2640000-0x000001B4E26A6000-memory.dmp
memory/6156-9159-0x000001B4E2590000-0x000001B4E2632000-memory.dmp
memory/6156-9160-0x000001B4E21B0000-0x000001B4E21BC000-memory.dmp
memory/6156-9158-0x000001B4E21F0000-0x000001B4E220E000-memory.dmp
memory/6156-9157-0x000001B4E21D0000-0x000001B4E21EA000-memory.dmp
memory/6156-9156-0x000001B4E24E0000-0x000001B4E2582000-memory.dmp
memory/6156-9155-0x000001B4DE950000-0x000001B4DE96E000-memory.dmp
memory/6156-9168-0x000001B4E5050000-0x000001B4E5088000-memory.dmp
memory/6156-9167-0x000001B4B6C40000-0x000001B4B6C50000-memory.dmp
memory/6156-9146-0x000001B4DE880000-0x000001B4DE8F6000-memory.dmp
memory/6156-9170-0x000001B4E5130000-0x000001B4E5174000-memory.dmp
memory/6156-9135-0x000001B4B6C40000-0x000001B4B6C50000-memory.dmp
memory/6156-9182-0x000001B4B6C40000-0x000001B4B6C50000-memory.dmp
memory/6156-9187-0x000001B4E8A90000-0x000001B4E8C16000-memory.dmp
memory/6156-9189-0x000001B4E9150000-0x000001B4E9678000-memory.dmp
memory/6156-9250-0x000001B4B6C40000-0x000001B4B6C50000-memory.dmp
memory/6156-9255-0x000001B4B6C40000-0x000001B4B6C50000-memory.dmp
memory/6156-9119-0x000001B4D0F10000-0x000001B4D0F5A000-memory.dmp
memory/6156-9113-0x000001B4D0D70000-0x000001B4D0D92000-memory.dmp
memory/6156-9112-0x000001B4DE570000-0x000001B4DE622000-memory.dmp
memory/6156-9111-0x000001B4D1090000-0x000001B4D1251000-memory.dmp
memory/6156-9110-0x000001B4B6C40000-0x000001B4B6C50000-memory.dmp
memory/7848-9047-0x00007FFCB22F0000-0x00007FFCB2300000-memory.dmp
memory/7848-9037-0x00007FFCB3880000-0x00007FFCB3881000-memory.dmp
memory/7848-9063-0x00007FFCB1780000-0x00007FFCB1790000-memory.dmp
memory/7848-9065-0x00007FFCB17B0000-0x00007FFCB17D6000-memory.dmp
memory/7848-9066-0x00007FFCB17B0000-0x00007FFCB17D6000-memory.dmp
memory/7848-9067-0x00007FFCB17B0000-0x00007FFCB17D6000-memory.dmp
memory/7848-9068-0x00007FFCB17B0000-0x00007FFCB17D6000-memory.dmp
memory/7848-9069-0x00007FFCB17B0000-0x00007FFCB17D6000-memory.dmp
memory/7848-9070-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9071-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9072-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9073-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9074-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9075-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9076-0x00007FFCB1580000-0x00007FFCB15A7000-memory.dmp
memory/7848-9107-0x00000295F8DB0000-0x00000295F8DB1000-memory.dmp
memory/7848-9108-0x00007FFCB3880000-0x00007FFCB3881000-memory.dmp
memory/7848-9062-0x00007FFCB1680000-0x00007FFCB1690000-memory.dmp
memory/7848-9061-0x00007FFCB1680000-0x00007FFCB1690000-memory.dmp
memory/7848-9060-0x00007FFCB1900000-0x00007FFCB190B000-memory.dmp
memory/7848-9059-0x00007FFCB1900000-0x00007FFCB190B000-memory.dmp
memory/7848-9058-0x00007FFCB1900000-0x00007FFCB190B000-memory.dmp
memory/7848-9056-0x00007FFCB1900000-0x00007FFCB190B000-memory.dmp
memory/7848-9054-0x00007FFCB18E0000-0x00007FFCB18F0000-memory.dmp
memory/7848-9057-0x00007FFCB1900000-0x00007FFCB190B000-memory.dmp
memory/7848-9055-0x00007FFCB18E0000-0x00007FFCB18F0000-memory.dmp
memory/7848-9053-0x00007FFCB23A0000-0x00007FFCB23AE000-memory.dmp
memory/7848-9052-0x00007FFCB23A0000-0x00007FFCB23AE000-memory.dmp
memory/7848-9050-0x00007FFCB23A0000-0x00007FFCB23AE000-memory.dmp
memory/7848-9049-0x00007FFCB23A0000-0x00007FFCB23AE000-memory.dmp
memory/7848-9051-0x00007FFCB23A0000-0x00007FFCB23AE000-memory.dmp
memory/7848-9048-0x00007FFCB22F0000-0x00007FFCB2300000-memory.dmp
memory/7848-9045-0x00007FFCB1230000-0x00007FFCB1260000-memory.dmp
memory/7848-9046-0x00007FFCB1230000-0x00007FFCB1260000-memory.dmp
memory/7848-9044-0x00007FFCB1230000-0x00007FFCB1260000-memory.dmp
memory/7848-9043-0x00007FFCB1230000-0x00007FFCB1260000-memory.dmp
memory/7848-9042-0x00007FFCB1230000-0x00007FFCB1260000-memory.dmp
memory/7848-9041-0x00007FFCB10C0000-0x00007FFCB10D0000-memory.dmp
memory/7848-9039-0x00007FFCB0FB0000-0x00007FFCB0FC0000-memory.dmp
memory/7848-9040-0x00007FFCB10C0000-0x00007FFCB10D0000-memory.dmp
memory/7848-9038-0x00007FFCB0FB0000-0x00007FFCB0FC0000-memory.dmp
memory/7848-9064-0x00007FFCB1780000-0x00007FFCB1790000-memory.dmp
memory/7848-9036-0x00007FFCB3450000-0x00007FFCB3460000-memory.dmp
memory/7848-9035-0x00007FFCB3450000-0x00007FFCB3460000-memory.dmp
memory/7848-9034-0x00007FFCB3450000-0x00007FFCB3460000-memory.dmp
memory/7848-9033-0x00007FFCB3450000-0x00007FFCB3460000-memory.dmp
memory/7848-9032-0x00007FFCB3450000-0x00007FFCB3460000-memory.dmp
memory/7848-9031-0x00007FFCB3430000-0x00007FFCB3440000-memory.dmp
memory/7848-9017-0x00000295F8DB0000-0x00000295F8DB1000-memory.dmp
memory/7848-9030-0x00007FFCB3430000-0x00007FFCB3440000-memory.dmp
memory/7848-9018-0x00007FFCB3890000-0x00007FFCB38A0000-memory.dmp
memory/7848-9029-0x00007FFCB33A0000-0x00007FFCB33B0000-memory.dmp
memory/7848-9028-0x00007FFCB33A0000-0x00007FFCB33B0000-memory.dmp
memory/7848-9025-0x00007FFCB39F0000-0x00007FFCB3A20000-memory.dmp
memory/7848-9027-0x00007FFCB3A80000-0x00007FFCB3A85000-memory.dmp
memory/7848-9026-0x00007FFCB39F0000-0x00007FFCB3A20000-memory.dmp
memory/7848-9024-0x00007FFCB39F0000-0x00007FFCB3A20000-memory.dmp
memory/7848-9023-0x00007FFCB39F0000-0x00007FFCB3A20000-memory.dmp
memory/7848-9022-0x00007FFCB39F0000-0x00007FFCB3A20000-memory.dmp
memory/7848-9021-0x00007FFCB39A0000-0x00007FFCB39B0000-memory.dmp
memory/7848-9020-0x00007FFCB39A0000-0x00007FFCB39B0000-memory.dmp
memory/7848-9019-0x00007FFCB3890000-0x00007FFCB38A0000-memory.dmp
memory/8468-1327-0x00007FFC91090000-0x00007FFC91B51000-memory.dmp
memory/8468-1299-0x00000213074F0000-0x0000021307BF8000-memory.dmp
memory/8468-1302-0x00007FFC91090000-0x00007FFC91B51000-memory.dmp
memory/8468-1303-0x00000213221D0000-0x00000213221E0000-memory.dmp
memory/8468-1304-0x00000213220F0000-0x0000021322114000-memory.dmp
memory/8468-1305-0x00000213223C0000-0x00000213224A6000-memory.dmp
memory/8468-1306-0x00000213224B0000-0x0000021322671000-memory.dmp
memory/8468-1326-0x0000021322680000-0x0000021323680000-memory.dmp
memory/8496-9183-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/8496-9253-0x000001FE54CF0000-0x000001FE54D00000-memory.dmp
memory/8496-9251-0x00007FFC86C40000-0x00007FFC87701000-memory.dmp
memory/8520-1334-0x00007FF6FB560000-0x00007FF6FBEC0000-memory.dmp
memory/8520-1328-0x00007FF6FB560000-0x00007FF6FBEC0000-memory.dmp
memory/8520-1329-0x00007FFCB3890000-0x00007FFCB3A85000-memory.dmp
memory/8520-1330-0x00007FF6FB560000-0x00007FF6FBEC0000-memory.dmp
memory/8520-1331-0x00007FF6FB560000-0x00007FF6FBEC0000-memory.dmp
memory/8520-1332-0x00007FF6FB560000-0x00007FF6FBEC0000-memory.dmp
memory/8520-1333-0x00007FF6FB560000-0x00007FF6FBEC0000-memory.dmp
memory/8520-1356-0x00007FFCB3890000-0x00007FFCB3A85000-memory.dmp