Malware Analysis Report

2024-09-11 05:40

Sample ID 240630-pvv5ta1ejk
Target https://github.com/LotusTrojan/Virus-Maker-VB
Tags
discovery exploit persistence
score
8/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
8/10

Threat Level: Likely malicious

The file https://github.com/LotusTrojan/Virus-Maker-VB was found to be: Likely malicious.

Malicious Activity Summary

discovery exploit persistence

Manipulates Digital Signatures

Drops file in Drivers directory

Possible privilege escalation attempt

Downloads MZ/PE file

Modifies file permissions

Executes dropped EXE

Boot or Logon Autostart Execution: Print Processors

Legitimate hosting services abused for malware hosting/C2

Modifies termsrv.dll

Drops file in System32 directory

Suspicious behavior: EnumeratesProcesses

NTFS ADS

Opens file in notepad (likely ransom note)

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Enumerates system info in registry

Suspicious use of WriteProcessMemory

MITRE ATT&CK Matrix V13

Initial Access
TA0001
Execution
TA0002
Persistence
TA0003
Boot or Logon Autostart Execution
T1547
Print Processors
T1547.012
Privilege Escalation
TA0004
Boot or Logon Autostart Execution
T1547
Print Processors
T1547.012
Defense Evasion
TA0005
File and Directory Permissions Modification
T1222
Credential Access
TA0006
Discovery
TA0007
Query Registry
T1012
System Information Discovery
T1082
Lateral Movement
TA0008
Remote Services
T1021
Remote Desktop Protocol
T1021.001
Collection
TA0009
Exfiltration
TA0010
Command and Control
TA0011
Web Service
T1102
Impact
TA0040
Resource Development
TA0042
Reconnaissance
TA0043

Analysis: static1

Detonation Overview

Reported

2024-06-30 12:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-30 12:39

Reported

2024-06-30 13:24

Platform

win10v2004-20240611-en

Max time kernel

1800s

Max time network

2618s

Command Line

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/LotusTrojan/Virus-Maker-VB

Signatures

Downloads MZ/PE file

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\en-US\i8042prt.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\BthMini.SYS C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\pmem.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\ipfltdrv.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\lltdio.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\mountmgr.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\storvsc.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\usbuhci.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\disk.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\mrxsmb20.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\raspptp.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\Dumpstorport.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\filetrace.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\xboxgip.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\mountmgr.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\pcmcia.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\ndistapi.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\acpipagr.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\volume.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\usbd.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\acpiex.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\tunnel.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\kbdhid.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\tcpipreg.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\mouclass.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\rfxvmt.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\scsiport.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\sermouse.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\Microsoft.Bluetooth.AvrcpTransport.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\sdbus.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\mstee.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\amdppm.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\CAD.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\wudfpf.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\portcls.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\raspppoe.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\USBXHCI.SYS C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\werkernel.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\Acx01000.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\IndirectKmd.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\KNetPwrDepBroker.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\volsnap.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\fvevol.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\IndirectKmd.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\tcpip.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\gmreadme.txt C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\ipnat.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\monitor.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\vmgid.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\dxgmms2.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\scfilter.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\fileinfo.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\rootmdm.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\tcpip.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\bttflt.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\Dmpusbstor.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\en-US\winnat.sys.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\mmcss.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\TsUsbFlt.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\disk.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\WUDFPf.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\sdstor.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\serenum.sys C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\drivers\UMDF\en-US\SensorsHid.dll.mui C:\Windows\System32\cmd.exe N/A

Manipulates Digital Signatures

Description Indicator Process Target
File opened for modification C:\Windows\System32\wintrust.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\pwrshsip.dll C:\Windows\System32\cmd.exe N/A

Possible privilege escalation attempt

exploit
Description Indicator Process Target
N/A N/A C:\Windows\system32\icacls.exe N/A
N/A N/A C:\Windows\system32\takeown.exe N/A

Boot or Logon Autostart Execution: Print Processors

persistence
Description Indicator Process Target
File opened for modification C:\Windows\System32\spool\prtprocs\x64\winprint.dll C:\Windows\System32\cmd.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\Downloads\Virus Maker.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\takeown.exe N/A
N/A N/A C:\Windows\system32\icacls.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A raw.githubusercontent.com N/A N/A
N/A raw.githubusercontent.com N/A N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\vidcap.ax C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\mprdim.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\lv-LV\SyncRes.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\es-ES\runas.exe.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\fr-FR\wshqos.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\itss.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\wbem\en-US\NetTCPIP_uninstall.mfl C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\C_WPD~1.INF\c_wpd.inf C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\rndiscmp.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\netbxnda.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\rdvvmtransport.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\ja-jp\racpldlg.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\wlidcli.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\WsmPty.xsl C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\config\SYSTEM~1\AppData\Local\MICROS~1\Office\OTele\OFFICE~1.DB C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\es-ES\c_netdriver.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\it-IT\c_media.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\ja-JP\termmou.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\uk-UA\FileHistory.exe.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\uk-UA\Licenses\_Default\PROFES~1\license.rtf C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\wbem\en-US\mstsc.mfl C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\es-ES\netv1x64.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\RDCameraDriver.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\FileRepository\netathr10x.inf_amd64_2691c4f95b80eb3b\eeprom_ar6320_3p0_NFA354xp.bin C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\mcicda.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\migwiz\dlmanifests\gpmgmt-DL.man C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\uk-UA\esrb.rs.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\uk-UA\ieunatt.exe.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\PSDesiredStateConfiguration.format.ps1xml C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\downlevel\api-ms-win-security-base-l1-1-0.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\es-ES\iaLPSSi_I2C.INF_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\wininitext.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\ja-jp\stobject.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\spp\tokens\skus\CSVLK-~1\csvlk-pack-Volume-CSVLK-3-ul-store-rtm.xrm-ms C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\Windows.Payments.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\fphc.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\fr-FR\AboutSettingsHandlers.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\rdpendp.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\fr-FR\mstscax.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\fr-FR\wcncsvc.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\RMapi.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\netip6.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\fr-FR\xboxgipSynthetic.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\wscsvc.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\WSDPrintProxy.DLL C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\zh-CN\chspy.spd C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\de-DE\quickassist.exe.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\es-ES\RmClient.exe.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\en-US\winusb.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\PlayToDevice.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\smbwmiv2.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\TrustedSignalCredProv.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\msvidc32.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\NetEventPacketCapture\MSFT_NetEventVmSwitchProvider.format.ps1xml C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\catsrvps.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\DriverStore\en-US\itSAS35i.inf_loc C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\sppcommdlg.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\fr-FR\taskbarcpl.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\it-IT\CredProv2faHelper.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\it-IT\dxdiag.exe.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\spp\tokens\skus\PR3CDC~1\ProfessionalWorkstation-Retail-1-ul-store-rtm.xrm-ms C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\APPVCL~1\ja\Microsoft.AppV.AppVClientPowerShell.resources.dll C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\en-US\XblAuthManager.dll.mui C:\Windows\System32\cmd.exe N/A
File opened for modification C:\Windows\System32\es-ES\IEAdvpack.dll.mui C:\Windows\System32\cmd.exe N/A

Modifies termsrv.dll

Description Indicator Process Target
File opened for modification C:\Windows\System32\termsrv.dll C:\Windows\System32\cmd.exe N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

NTFS ADS

Description Indicator Process Target
File opened for modification C:\Users\Admin\Downloads\Unconfirmed 763099.crdownload:SmartScreen C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Opens file in notepad (likely ransom note)

ransomware
Description Indicator Process Target
N/A N/A C:\Windows\System32\NOTEPAD.EXE N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of SendNotifyMessage

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A
N/A N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2800 wrote to memory of 2272 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 2272 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 804 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4708 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
PID 2800 wrote to memory of 4260 N/A C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Processes

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/LotusTrojan/Virus-Maker-VB

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe808046f8,0x7ffe80804708,0x7ffe80804718

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Windows\System32\CompPkgSrv.exe

C:\Windows\System32\CompPkgSrv.exe -Embedding

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5572 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2352 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5116 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2300 /prefetch:1

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6196 /prefetch:8

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2072,13375584071556775736,7650675328294145310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8

C:\Users\Admin\Downloads\Virus Maker.exe

"C:\Users\Admin\Downloads\Virus Maker.exe"

C:\Windows\System32\NOTEPAD.EXE

"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\bro.bat

C:\Windows\System32\cmd.exe

"C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Desktop\bro.bat"

C:\Windows\system32\takeown.exe

takeown C:\Windows\System32

C:\Windows\system32\icacls.exe

icacls C:\Windows\System32

Network

Country Destination Domain Proto
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 github.com udp
GB 20.26.156.215:443 github.com tcp
US 8.8.8.8:53 215.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 80.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 avatars.githubusercontent.com udp
US 8.8.8.8:53 github.githubassets.com udp
US 185.199.110.133:443 avatars.githubusercontent.com tcp
US 8.8.8.8:53 github-cloud.s3.amazonaws.com udp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 8.8.8.8:53 user-images.githubusercontent.com udp
US 8.8.8.8:53 private-user-images.githubusercontent.com udp
US 185.199.108.133:443 private-user-images.githubusercontent.com tcp
US 8.8.8.8:53 133.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 154.110.199.185.in-addr.arpa udp
US 8.8.8.8:53 133.108.199.185.in-addr.arpa udp
US 8.8.8.8:53 collector.github.com udp
US 140.82.114.21:443 collector.github.com tcp
US 185.199.110.154:443 github.githubassets.com tcp
US 8.8.8.8:53 api.github.com udp
US 140.82.114.21:443 collector.github.com tcp
GB 20.26.156.210:443 api.github.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 21.114.82.140.in-addr.arpa udp
US 8.8.8.8:53 210.156.26.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
BE 23.41.178.59:443 www.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 59.178.41.23.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 raw.githubusercontent.com udp
US 185.199.110.133:443 raw.githubusercontent.com tcp
US 8.8.8.8:53 github.com udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 9.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32

\??\pipe\LOCAL\crashpad_2800_RWZQAQMQLGVLTHZP

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 4cc265ae851b0fe14a5a7801460aa76a
SHA1 1c44b50f9aec621b5e3771d7388300fc3574ff86
SHA256 47ae42997f1d78d7b505d304c5d3c7321832f3d5e16f9af1f7d187e653889058
SHA512 b0ff599fe47484431c866e7109202f0d679dba246ba1854ea5b25530e3cf471a979d00efd5086b9dc1f27a7d1e4672c2cfefb6ab44aa5c5ba7919442aa8a85b2

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 4e62f37998f1de4fe4d34bd27640e6d5
SHA1 fedf443116a0beed9fbcc4a661660744ce0b1dc2
SHA256 e94d967cbef6ea352deb8a808748d87df686252d4ab82e364a0de76dd3c37a90
SHA512 c3c45ca7749711e71fd993480251815e44ca4977f6e6652f7b8daa1002bfd4d3b3340b2875757da90612590fb6aeb03b3f8f6ccc3e740c884e02df3f0ea71434

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 adabe229b4b701fea1bb3c323d62e814
SHA1 8b112c9165e824fcdf98cb64b1d2792741eb2943
SHA256 513550206d0387418c93c57c6daa7462efb1f4990dbfe4475bd012fcc6579560
SHA512 dc988b937e28522ed96780304a9213341a9ea7f6280fa7493c7f5dac567bcf5c217ce1501eb4a6e9476e66ebb31c512881e355088fbce6aad63edec3284f1d57

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57855c.TMP

MD5 db79801a49cbb68bf8133ab311fa6e24
SHA1 4579a40b2162828a0335365cb8d0abc2fe45cfe3
SHA256 81bd84e8b13db1ef137672a9ef1177aa09f0d13abc9ac8c177ff54497ba83cda
SHA512 a743d3c2aa7183a99e35c0e8984eae892f31e206383268ecfc739a19f606ad8f5d2a996dd8f02c80aa51c13c302f6cd2abe3225f4e63af634095d7f50e61fdab

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 0b2f74472565bcab6664c65b3462090a
SHA1 f621170113d96da4da9588713b51a0580517e0a7
SHA256 8a9480eeccc06cdb30aeed65009388d30a9034bcf2a3355c5474bd66419ac9d1
SHA512 7f46268818951abfdc4bb888642ac0f0416ddcd8ba85b03a57bba8f942e290620de51ac06b609781c4ffb36e0c698fe513b3819d7966af6e4ff85a09afe9f138

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 1f62c604efc249ef6a41a720f90d7da6
SHA1 5a458f95a595d8659e425c56f7df913e83a929d3
SHA256 0f071b91bd2bbc76c08e8c7c9a513e2700140c8bd3fd85352af9d347ed88afba
SHA512 5ce8664179c394a2b69c08d164273ea826295621a22e3ef8e947893ba51999113a8e7d3079bd6f9cd3a3730fa91fe456e90161925a6975041fe489974e01eb24

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

MD5 86d1eec673a4dcc2ab91ede6e088d0e3
SHA1 a5fc225450df518826bd96226ba6b750bed2f849
SHA256 ec8da24deb9b91eaa142dff62ed0e9f045d5351c1acf4eb3b3dd7d3365974601
SHA512 eefea99bf4912588fc1bb26c603463b6caa5845adeceb682cffea9af76a28fb561b0c58fc8ee1a89dac85dc0c95a0f50bf596efa68c9cf5b8e6e9343efee0cb5

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 e52950d1d9bcb59f21bda1198bef1046
SHA1 dd9c089d511ee4400377b2a9383afe56a21be7b3
SHA256 9a83b8b503eed3a0ee86ecfa6d295a39b0ede9b8aa971341064cc91c473738d6
SHA512 65a6785044b20c4c3cdb4c5b64d396436fed4bb5d214e5548cafb22fb651bce76183cd6d0c1ad6df702267e775ac8ebceb48af6502e85981da800ba9c65a599a

C:\Users\Admin\Downloads\Unconfirmed 763099.crdownload

MD5 584f1f458f1f7fbe966cea5fded1fd91
SHA1 5e97ba311228796ac9cfd0556d96cb6c22111a3a
SHA256 0dfa569df3b8b2b075d29cd63c5a35a5473b89b355fad0af2c5aa148346edc70
SHA512 572f3593a6d3c7efb612f42ab647ab33073ef1c64ab46697b3e0024c9425cf20e307b0b815e742e65b2be728b084662e4ae53e730dd3263e9a5825c52392a7c3

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

MD5 15252235f21cc9e37d8294e63138d927
SHA1 8fd9ea221ff37011ae9a19c067b4e3cdd87d8f27
SHA256 4b0b4e2996af206538f0358b7cce2da21b0e7f22897f46b8a2555586ba4082ce
SHA512 5db4c7c182ba9b0387a849460297423d44ebe7c90f0838eb202e51987df380b0459460d1387acb7be5d808a20e1faf0bbfde1d6cea42649eaff3ded59dffdc97

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 281501ee4d0b8414a6f373cb43f2cb5d
SHA1 9c6688ba064a85ae11f5483caa22e86b3a2a3bbf
SHA256 80f01656bcfefdee91304f1b3cfb121160d89dd215f70532a1c3790b8a729e88
SHA512 30acd2d34a603c5e9aec65b0335434dd24739a473a31415d744e2e50be571be5d1515d1eccf40da908786716871a170987f3da26a87a070bccad00bb58f62c99

memory/456-354-0x00000000008B0000-0x0000000000CB8000-memory.dmp

memory/456-355-0x0000000005580000-0x000000000561C000-memory.dmp

memory/456-356-0x0000000005BD0000-0x0000000006174000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 38814757bed1b394fc225f44c1384214
SHA1 5c0405a2964d8b5ea3736d4c3f182d97bf7ead67
SHA256 0aca0d43c630d3477c5f6e619a56e1841ee38d8ac699270935615d1fb06af69e
SHA512 65a80226f2be9fd62d40d1d321a489839bdcff093d40e6e67860a01a6ea4bbfc33e435218cdbaefcd8ef62514540d83a81043280d659bea85e3c1828af52f45c

memory/456-362-0x0000000005620000-0x00000000056B2000-memory.dmp

memory/456-363-0x0000000005560000-0x000000000556A000-memory.dmp

memory/456-364-0x0000000005820000-0x0000000005876000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

MD5 cdb3987a4863b47a290b91dabd1cf73e
SHA1 62752d7a69edd7c799686b4087e62c06469c7a08
SHA256 9620a03a074aa27a35381c1d2a24878c8b78994767ec5f8d374c9c40c6efefa7
SHA512 46c70ced19c92b94b94c9939ae54448ef35c63c238f81e0f5bfd6e21cb233509ae29f57eebf5ac1b65967d0b1b383b3901a17286330f474bf744ab1734de956a

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

MD5 dbb5a0c4504ee122d0a6a46530d0066d
SHA1 709fcf91a4be91488ecae537785760179b1e42ed
SHA256 e35a0373ac9eee9da25a3a9a2aaa7f770279d72138d7655b6fe15c6570db36b2
SHA512 17f296e0b2802250df2bfb95aaeb84b592504fa205282436b5055c4d06361426e9573bda36f57a7e5cd44a0dba9d4773059267908996e2bd050deccfc341e85d

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

MD5 1d9bf44973c18a2a639d1ed1eb792d88
SHA1 4ca08303ca556d377ec860d8e8526a257afba41a
SHA256 425622de3fd0a3557af7b98894d3e97dbbb3f0624b64567df01c3097e0383647
SHA512 3a682153587571be751d257cb4aeeea94af2315a138c9836d68a51328863b741707674c9fa879c78edfb6b322648cadc5ecab1eb6025b267d086e23c9e2aa36b

C:\Users\Admin\Desktop\bro.bat

MD5 57b50a6ac39ca6bb5def00ab473eebb8
SHA1 2c9c6131c56461bf0d845182294cfd89262aa655
SHA256 51a7bacfcd60d7d7ceaa35b07097f9ae9215b95d1cae22eb1e80d5f9a21d4935
SHA512 b59642aeb6fa9dd5674807319a6064c2508b5c02dd4093bd7cdf1b4a1183b4a5faee55c155c4fc3009b6f0545cac1a1e32ea7ac4333ec3504abbec9e69bcc71b