hxxps://github[.]com/PabloMK7/citra/releases/download/r4f174f1/citra-windows-msvc-20240615-4f174f1[.]zip

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
29/06/2024, 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/PabloMK7/citra/releases/download/r4f174f1/citra-windows-msvc-20240615-4f174f1.zip

Score

1^/10

Malware Config

Signatures

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3169499791-3545231813-3156325206-1000_Classes\Local Settings	taskmgr.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3152	msedge.exe
3152	msedge.exe
3676	msedge.exe
3676	msedge.exe
3032	identity_helper.exe
3032	identity_helper.exe
1452	msedge.exe
1452	msedge.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6124	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6124	taskmgr.exe
Token: SeSystemProfilePrivilege	6124	taskmgr.exe
Token: SeCreateGlobalPrivilege	6124	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
3676	msedge.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe
6124	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 4708	3676	msedge.exe	83
PID 3676 wrote to memory of 4708	3676	msedge.exe	83
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 532	3676	msedge.exe	84
PID 3676 wrote to memory of 3152	3676	msedge.exe	85
PID 3676 wrote to memory of 3152	3676	msedge.exe	85
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86
PID 3676 wrote to memory of 1508	3676	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/PabloMK7/citra/releases/download/r4f174f1/citra-windows-msvc-20240615-4f174f1.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa06e046f8,0x7ffa06e04708,0x7ffa06e04718
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,6067345405891714563,2790688058165575161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3232 /prefetch:2
  2⤵
  PID:4412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5192

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe"
1⤵
PID:5624

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-qt.exe"
1⤵
PID:6032

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6124

C:\Windows\System32\-1hxuj.exe
"C:\Windows\System32\-1hxuj.exe"
1⤵
PID:4008

C:\Windows\System32\-1hxuj.exe
"C:\Windows\System32\-1hxuj.exe"
1⤵
PID:4816

C:\Windows\System32\-1hxuj.exe
"C:\Windows\System32\-1hxuj.exe"
1⤵
PID:4904

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra.exe"
1⤵
PID:980

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:5596

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:2820

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:3996

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:5680

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:64

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:2308

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:3776

C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe
"C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1\citra-room.exe"
1⤵
PID:5844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
959ac946540e70494f5c9ed03273e3bb

SHA1
c5ed92ee334cceb5791b35a7567166d9890bd1b2

SHA256
c9d132db8e31d0d4e7cfb507f385656a22e236ef24390ece8d347e123ff69ccd

SHA512
da49b62f9c9a6e6ed63e2bcd526bdd5edf55bf02f0ea88c9acde2e2d2b7b012a473889c356b8ced55b54f4646c719c42a67d63ff379b4165b87571e7833a45ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0d2034ba111427761392d70003b7819d

SHA1
37ac6b3550ac3f4cb1d504aa1c4192055b231bf7

SHA256
ca888ace13ac502297007da60db8f1d8c84995a394e7b4353b5070a25eb5b53b

SHA512
8bbab2586a0952729a6e4321164e946df7806a7f359eddce9cc6225f9fecc448d8660a167919bf97fe5fd47e1fb425b2a643a40e09577ba6880a22f7c7dadc08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bbb17dcc2615a6ffa9faef18c1c91c23

SHA1
60c24086a88d6a782df163142ba2193559be87f6

SHA256
2cd2fe8c876055fffb33653233417f50917d38dc7d356d86502fed3ecfd6b9f6

SHA512
d049af530956181c62aaae34f3c01958df7c31580c96e3449e92f0ff0c287ef271a61ddbc0ea647e7e145c2c1c8e621cd5f8a0f2c05ae38cbda7e0b88670aa06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5845b74f03708fc931d8b3eb0f6ffcd2

SHA1
68c48db6757a5bcac174c86c4d41d46044cbe406

SHA256
5c36fbded62edda9ea94e3acd5fe582614a98aa45742541684b45b90d29790a0

SHA512
9bf6ac5fa7db77119a17fcd52e1140437104b680d4a21c2329c84d5efb8e755e56231b2ad888721d921c5299654ade4c9ba9ccb8e76343e08ff757c94336a751

Download Submit
C:\Users\Admin\Downloads\citra-windows-msvc-20240615-4f174f1.zip

Filesize
29.9MB

MD5
eff9bb6ece503093bd38d32fb2b0505b

SHA1
449e00124de04fbfb06b1b2138c5625143c67e86

SHA256
aa87f77130862487c813d0ae1e60b60dec7874fc721c842beb2bee64951ce3d9

SHA512
09d4b88da10d1fc891c780dceb9a8d9645149d6be29f4156fa9e29a7b3f4a18a07f344f58323be9b60eafada3785262e2a090a5510bc93be3f389ebde0bfb754

Download Submit
memory/5624-101-0x00007FF660EA0000-0x00007FF661EA0000-memory.dmp

Filesize
16.0MB

Download
memory/5624-102-0x00007FF660EA0000-0x00007FF661EA0000-memory.dmp

Filesize
16.0MB

Download
memory/5624-100-0x00007FF9F1B60000-0x00007FF9F218A000-memory.dmp

Filesize
6.2MB

Download
memory/6032-106-0x00007FF9F24C0000-0x00007FF9F2AEA000-memory.dmp

Filesize
6.2MB

Download
memory/6032-107-0x00007FF660EA0000-0x00007FF661EA0000-memory.dmp

Filesize
16.0MB

Download
memory/6124-121-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-109-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-111-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-120-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-119-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-118-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-117-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-116-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-115-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download
memory/6124-110-0x000001DB2C270000-0x000001DB2C271000-memory.dmp

Filesize
4KB

Download