3d5d9bc94be3d1b7566a652155b0b37006583868311f20ef00283c30314b5c61

Resubmissions

25-05-2024 16:17

240525-trfyyaac4v 7

25-05-2024 16:13

240525-tn9rvaab61 7

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 16:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

geometry dash auto speedhack.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

geometry dash auto speedhack.exegeometry dash auto speedhack.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

geometry dash auto speedhack.exe

description ioc process

File opened for modification \??\PhysicalDrive0 geometry dash auto speedhack.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	geometry dash auto speedhack.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

geometry dash auto speedhack.exegeometry dash auto speedhack.exegeometry dash auto speedhack.exegeometry dash auto speedhack.exegeometry dash auto speedhack.exe

pid	process
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
4276	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
2456	geometry dash auto speedhack.exe
4616	geometry dash auto speedhack.exe
4720	geometry dash auto speedhack.exe
3796	geometry dash auto speedhack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AUDIODG.EXE

description pid process

Token: 33 1116 AUDIODG.EXE
Token: SeIncBasePriorityPrivilege 1116 AUDIODG.EXE

description	pid	process
Token: 33	1116	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1116	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

geometry dash auto speedhack.exe

pid process

4564 geometry dash auto speedhack.exe

pid	process
4564	geometry dash auto speedhack.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

geometry dash auto speedhack.exegeometry dash auto speedhack.exemsedge.exe

description	pid	process	target process
PID 4672 wrote to memory of 3796	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 3796	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 3796	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 2456	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 2456	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 2456	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4720	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4720	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4720	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4616	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4616	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4616	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4276	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4276	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4276	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4564	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4564	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4672 wrote to memory of 4564	4672	geometry dash auto speedhack.exe	geometry dash auto speedhack.exe
PID 4564 wrote to memory of 3044	4564	geometry dash auto speedhack.exe	notepad.exe
PID 4564 wrote to memory of 3044	4564	geometry dash auto speedhack.exe	notepad.exe
PID 4564 wrote to memory of 3044	4564	geometry dash auto speedhack.exe	notepad.exe
PID 4564 wrote to memory of 3528	4564	geometry dash auto speedhack.exe	msedge.exe
PID 4564 wrote to memory of 3528	4564	geometry dash auto speedhack.exe	msedge.exe
PID 3528 wrote to memory of 3368	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 3368	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe
PID 3528 wrote to memory of 5000	3528	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4672

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3796

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2456

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4616

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /watchdog
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4276

C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe
"C:\Users\Admin\AppData\Local\Temp\geometry dash auto speedhack.exe" /main
2⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564

C:\Windows\SysWOW64\notepad.exe
"C:\Windows\System32\notepad.exe" \note.txt
3⤵
PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe22e946f8,0x7ffe22e94708,0x7ffe22e94718
4⤵
PID:3368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
4⤵
PID:5000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
4⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2708 /prefetch:8
4⤵
PID:3000

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
4⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
4⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
4⤵
PID:4332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
4⤵
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
4⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
4⤵
PID:4076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
4⤵
PID:996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
4⤵
PID:3600

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
4⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
4⤵
PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4196 /prefetch:1
4⤵
PID:4236

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
4⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
4⤵
PID:884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
4⤵
PID:1576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
4⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,1057523026229314715,4278391884128215041,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
4⤵
PID:3648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus+builder+legit+free+download
3⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe22e946f8,0x7ffe22e94708,0x7ffe22e94718
4⤵
PID:1160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
3⤵
PID:4324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe22e946f8,0x7ffe22e94708,0x7ffe22e94718
4⤵
PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
3⤵
PID:4440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffe22e946f8,0x7ffe22e94708,0x7ffe22e94718
4⤵
PID:2644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x40c 0x2ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Filesize
206KB

MD5
f998b8f6765b4c57936ada0bb2eb4a5a

SHA1
13fb29dc0968838653b8414a125c124023c001df

SHA256
374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

SHA512
d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
20a3a5d0d6b5d99ed4a0df6cbbdddac7

SHA1
5aadc3343cfdd0b0e62c47ed77852f0bcd15e5d7

SHA256
0597e2d587e9c0c34272811201ac19d3d6b48f6a732aad7967a78cb9a48a65b0

SHA512
78c7a3bc27a1e2020bf0d12a18babd9b932d4ccb5338574ff09b446a7c2a2b7cd8b9acc7efc9510c294e58081f10968bd9b315af51e2cc47c80163375a1cfadf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
144B

MD5
bda68af8d7f625a59738169a2d8e89d0

SHA1
b8c08dbb669157bc23144c8fbbac23e417e4b560

SHA256
a35076e25a8c1ad99838b1929d37830e5b867d86de1bc50396dc057f88070d6f

SHA512
b1bdc15eb31919a07b9296bf34881ca6be7f1e8dc528fa8efde7e088cf4e6be7c48c403de273d24dfff0b3980c04c31cb1e2031db0c64ced6346cf7109d7032b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
9dfa847ca76ce3d1647e7fa995064546

SHA1
3e53e823adae4aed5a633a75aa491399bde1835b

SHA256
ea33e77540f4ad14866bc5f4b8a4f64538721a93a019e048f154581eb104f71a

SHA512
4e6a68c757c0418b4b056382b2a98a34bdf623f01b92911b615b706a0350a2255f16abcfb842ef75557c831ba043254aa93ff97750fc80d464b8287c28bea3b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
168B

MD5
396445221a3c6a445355cb9b3f27c3cf

SHA1
da6ad8c328cdcc457f1272a877940d4b3428399c

SHA256
d1a61f657a01bb59553085269323d032af9d78060e7288df852f52a0ca40ddf6

SHA512
7bca1b082fae73ec97e91aa840a4de2ddfc6d4ac726a7705815e7f9f647a96f5db52ed00bce5f7a336e75a21aabad87d31e53562f843b51a27e27315d7339993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
784B

MD5
147427803a7f7c29cb8ce085e50ed6a9

SHA1
74f51956856bb4a2fbc37d4b3c84009019e4e8e7

SHA256
bd6dbca0ab7bb00d7f6b49c7ec536511785283159a5ac82d741413d81c322d86

SHA512
4d6033240a833ba209ad1ccec8a994345e48e0055056ca972bca304c5453ee1fea0626fa035def9cc24104f6eba9b772d507709d972abbe457381e2818d1d6c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
5c2bb9292b84c04e3358636a3983d4b2

SHA1
f325eff1fc1bcdb85b47d7af24ae9e7153817c90

SHA256
14fecb0de13baff9d6b39e2a646c8756ac6326525ad0c82e07e7471308dbaf00

SHA512
c71361688be6e3860cd349ec7ed1707a736b582058fe40b1c2ced1f03d3e74e21c691fb7de115b2dae488c8216d760702cd0ac9b54ca127aa20ea589f8158545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
274580b6b9958172ed377b1ebe0fc33e

SHA1
49548ae2e1d4de6c6d8bec5c91b89570c9701d9b

SHA256
5671622d448d02012af16c5e8dabc7c4926cdc0558bc010de83317add9f6e772

SHA512
5e81559f24ec1bf9fdb8b278f023e9dff3225a6c83c678eb8a78ded1ed0721af191e473ef1c7436dd4fa9f18cf525ccd5708c32c42f8f2bb092054666c653675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
0bc81e262e30cc5d97ac221523972ac5

SHA1
8f7cc31ad829172bbeddfb6b2f7e316f1f95214c

SHA256
cfc75ed0300a91f7f3c7469e49ba3cbd6a926421f13afc7391b3a477a1cc171f

SHA512
090547638a86edd52812c5a149187b2cd775b0ffb8b4713a771c47aaa513c38418353ce1628d3e09207f96aed1d55985a9f331447082b78ef8d450021ddec7c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e5a23451623f3b58e8d8a3af4451dbc0

SHA1
e20f23245cb990ab05ae066e3cf700c8071a4f47

SHA256
352b2b9b61e7451f379ff72ce16176b801dedc1039ed15fc8288bbeccc43b0ba

SHA512
2381e798ca1f51ed4fedee147f04dce9d1217a6c6d1c4bb74c2833ac89ca434cf70603f6ecdbe3ae70e59d2cb59154e65c24b9df710554b1755aa0163e0f9820

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
e78ca6641fb71e4966660878c8ac4b28

SHA1
a706d02df492a77f05de7d3687822fd8d5ff56f6

SHA256
6be43bef5991f5eaad07d08a8a5195d089a186d63ff7be8015a79e8b5ea6ed3e

SHA512
d36aed13291b41deb8fc8387bb4fd2f4a283fcac226c2288fe6660705c14d90395a16c9dd30259a8ccb91abf09b691933fc9f77683e5860d6bbd329e65d271b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
dfe97c27dc54d596f2411f690e4f6307

SHA1
95168d1ea6077ba1cf627f9c45ef770cc2c562c2

SHA256
48672820ae824a09c988912a47bee661b59ecf2cd79648eecff915b5d4d14f05

SHA512
c03175b1b9476f08e962f67c92423690c4fe4daa55c77cfdb5c86d1e6a0c23aca6c142d71a8a97ee3b53670badbc6da84be9a17f22688c946f9707a7b623d07b

Download Submit
C:\note.txt
Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
\??\pipe\LOCAL\crashpad_3528_TVGBPHXOAHSYUYGJ
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit