2ca4803498d7d375a61bfab2a3a4cf7e0eec41d116e50a838791a55b164e0f8c

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-01-2025 08:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Malware-1-master/MEMZ-Destructive.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	MEMZ-Destructive.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ-Destructive.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ-Destructive.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1792	MEMZ-Destructive.exe
1788	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
1820	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe
4312	MEMZ-Destructive.exe
4076	MEMZ-Destructive.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	460	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	460	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4480	MEMZ-Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3036 wrote to memory of 1788	3036	MEMZ-Destructive.exe	93
PID 3036 wrote to memory of 1788	3036	MEMZ-Destructive.exe	93
PID 3036 wrote to memory of 1788	3036	MEMZ-Destructive.exe	93
PID 3036 wrote to memory of 1792	3036	MEMZ-Destructive.exe	94
PID 3036 wrote to memory of 1792	3036	MEMZ-Destructive.exe	94
PID 3036 wrote to memory of 1792	3036	MEMZ-Destructive.exe	94
PID 3036 wrote to memory of 4312	3036	MEMZ-Destructive.exe	95
PID 3036 wrote to memory of 4312	3036	MEMZ-Destructive.exe	95
PID 3036 wrote to memory of 4312	3036	MEMZ-Destructive.exe	95
PID 3036 wrote to memory of 1820	3036	MEMZ-Destructive.exe	96
PID 3036 wrote to memory of 1820	3036	MEMZ-Destructive.exe	96
PID 3036 wrote to memory of 1820	3036	MEMZ-Destructive.exe	96
PID 3036 wrote to memory of 4076	3036	MEMZ-Destructive.exe	97
PID 3036 wrote to memory of 4076	3036	MEMZ-Destructive.exe	97
PID 3036 wrote to memory of 4076	3036	MEMZ-Destructive.exe	97
PID 3036 wrote to memory of 4480	3036	MEMZ-Destructive.exe	98
PID 3036 wrote to memory of 4480	3036	MEMZ-Destructive.exe	98
PID 3036 wrote to memory of 4480	3036	MEMZ-Destructive.exe	98
PID 4480 wrote to memory of 856	4480	MEMZ-Destructive.exe	100
PID 4480 wrote to memory of 856	4480	MEMZ-Destructive.exe	100
PID 4480 wrote to memory of 856	4480	MEMZ-Destructive.exe	100
PID 4480 wrote to memory of 720	4480	MEMZ-Destructive.exe	108
PID 4480 wrote to memory of 720	4480	MEMZ-Destructive.exe	108
PID 720 wrote to memory of 3996	720	msedge.exe	109
PID 720 wrote to memory of 3996	720	msedge.exe	109
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110
PID 720 wrote to memory of 2332	720	msedge.exe	110

C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
"C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4076
- C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe
  "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Destructive.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa385146f8,0x7ffa38514708,0x7ffa38514718
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
      4⤵
      PID:2332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
      4⤵
      PID:1872
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
      4⤵
      PID:4460
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
      4⤵
      PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
      4⤵
      PID:936
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
      4⤵
      PID:2636
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:4876
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:2404
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
      4⤵
      PID:3152
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
      4⤵
      PID:860
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
      4⤵
      PID:1056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
      4⤵
      PID:2240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
      4⤵
      PID:1516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
      4⤵
      PID:632
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:2512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
      4⤵
      PID:60
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,3535500200467069388,18202502481152974533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
      4⤵
      PID:4064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=mcafee+vs+norton
    3⤵
    PID:3020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa385146f8,0x7ffa38514708,0x7ffa38514718
      4⤵
      PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=montage+parody+making+program+2016
    3⤵
    PID:1656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa385146f8,0x7ffa38514708,0x7ffa38514718
      4⤵
      PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
    3⤵
    PID:2448
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffa385146f8,0x7ffa38514708,0x7ffa38514718
      4⤵
      PID:3820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x410 0x50c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
215KB

MD5
d79b35ccf8e6af6714eb612714349097

SHA1
eb3ccc9ed29830df42f3fd129951cb8b791aaf98

SHA256
c8459799169b81fdab64d028a9ebb058ea2d0ad5feb33a11f6a45a54a5ccc365

SHA512
f4be1c1e192a700139d7cff5059af81c0234ed5f032796036a1a4879b032ce4eedd16a121bbf776f17bc84a0012846f467ad48b46db4008841c25b779c7d8f5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
98c354cfa4997f79ac2b125e140018d2

SHA1
4c1d96bde2dcb41e1142ab22015bf377b7463301

SHA256
461673e716b0cd73d9d89c34ceb891eafc8039839b505f20461720f1ced95db6

SHA512
f0a34b3424c4bd1ae8656b6248564258eefdb5b68dca6325a0b1e5f4c41c619ab617b65c5d03fb1f290c7af32198dcde48f324e36861b6758efba9318917b5f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
9777296cfd9064930c2380624c5d0803

SHA1
ffbe1804d2986f305774a32caa102d7d2fe9e4bd

SHA256
08e4f41a042c03c6480278b99698662bc0be603d3fd3bd8145d78b27200a9b51

SHA512
54207741ef9cd8c2fd67e936ada7bca64733aaef88ae0f8dffd8967fa17c681d079582b374c61da8084e7116bc63d9f4ab4dd2f3f726df723da251579ecf4d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2d2a8c12336f5963004e86d0290936c6

SHA1
8a020c565aca58dd7918afef4abf519ca302a228

SHA256
b6a7888069add2ff0aa736107fae4abebb12128eac811f9d3c93a620752b4834

SHA512
dadbbb5aa09233425cc5a866ed9f5a4c57b31586a1d4a3f2217dbb68a7d5f1197fdcd370e974b2987d3a4dad6a28c08f4cb86cf5ed8a0339ddca875ce84e1c74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
783B

MD5
ca1978eb3a763b26ee1de77be4686b62

SHA1
3eb4e5e041245b787679969e39d231236dbdc5c7

SHA256
98985c6e30d3d94ea353adf0642c68743f6fb475d0cc1131dc666a08799aa4e6

SHA512
be9a3115c6f128f6ba7b50d684a4df766b26cdb67f53d5ec8ada585d76d43c9e3b9ada05e67636dc0f79ea728c6daadd62cd8a46ad073d70c2bb67623b6696d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f1d9b0ad96347a86f301eda745344b5

SHA1
06f3f8045ff1c7ed58169231dd99280154051f5e

SHA256
d4c2a1ff2944f34ad827ea0fb1fe393af57429b64d5a29e5f284efa48b4de553

SHA512
939c190ce5aac92a43a4084e4d3e92ea8cbfd18268885cd457fa9fd8e7c9fbb52a1ca06548c6d32cb211e52c4ef016e813154a54fcea5b3e8961b4c14d956775

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c45370f7b74f449f79d4e4beb60570e4

SHA1
e541acca254217be659fb0930967a400ccc93cb2

SHA256
58916f883a138e35532b9b99c4bdeba1dc52fb1a08194dc94887242bf9a6e018

SHA512
5f5783209b8346960a7ff5864b3771dbf4bf282640e2dd6ae4ebc01f8651445f7dbd0ca9e403d873783f5ab1b1d352c20739ccf5c4dc801dfc913fc0d39a9b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
dfda1a87a517004de0d0ff1c1ef265e2

SHA1
0b6fa63d3beb6987294b870943b7c153575680ca

SHA256
5e182da5e435c3b878b32cae91a02981e5072309b58015ab93c9568e4bab36fc

SHA512
c0f5299b81a133a16f17f25ba67a94dce8e7feb47bd09f4dc23d23b26a4882e590363da30a668a002e6e8c867935c5f924094771597900c7349e85e999e6e4b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e852ff21e88db8db85c802764547bb76

SHA1
5a9a140794bfdc3bee68bab2ba78bb237e64eebe

SHA256
1fad9eba1cda835810dce9c509e0448b29ba1118a4b928801f93539465fe5be7

SHA512
a453c22b877f506e4b79d3e0cf9730b94125da92fc66ea025275b5009f316382ce806a91bd357d697798ec71fe15bf4b46b23008a5a7539a36878c7a1895a7ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3a57133e67d8b73f13ed34ed8f51764

SHA1
af9534db733a3733cce5b19845bb502d67678741

SHA256
7c87b28188180740d4ab411cc0e10ab3ab975f4f0752cb7274d7fdc83db40f20

SHA512
ef3e6f457acb69bd7388a3ffe3d577fc0705151ca31c59dba2cb3fa62342423f6b0b89d57eff7edf72833a642cb4c840f80de23a3b09c174399e252c7f572a47

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit