hxxps://github[.]com/TheDarkMythos/windows-malware

Resubmissions

25/03/2025, 19:55

250325-ym9gxa1yct 10

25/03/2025, 19:51

250325-yky86a1xh1 10

25/03/2025, 19:35

250325-ya1dgavm12 10

25/03/2025, 19:32

250325-x849msvmw6 8

Analysis

max time kernel
146s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
25/03/2025, 19:32

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/TheDarkMythos/windows-malware

Score

8^/10

bootkit discovery persistence

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
66	2188	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	geometry dash auto speedhack.exe

Executes dropped EXE 7 IoCs

pid	Process
708	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
5012	geometry dash auto speedhack.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
65	raw.githubusercontent.com
66	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	geometry dash auto speedhack.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	geometry dash auto speedhack.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	Taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	Taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	Taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133874047633873737"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3218366390-1258052702-4267193707-1000\{BDB82FA4-81F7-49F4-9782-73F43688F20C}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3218366390-1258052702-4267193707-1000\{EE8986F3-FE75-4677-A7B1-6DF4A6CA05F5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3218366390-1258052702-4267193707-1000\{430E7B36-D9BB-4727-86C1-33D6767A3786}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
7136	msedge.exe
7136	msedge.exe
7136	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe
Token: SeShutdownPrivilege	2784	chrome.exe
Token: SeCreatePagefilePrivilege	2784	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
3984	msedge.exe
3984	msedge.exe
3984	msedge.exe
6064	msedge.exe
6064	msedge.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
7136	msedge.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
7136	msedge.exe
6768	Taskmgr.exe

Suspicious use of SendNotifyMessage 61 IoCs

pid	Process
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
2784	chrome.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe
6768	Taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
708	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
5012	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
3472	geometry dash auto speedhack.exe
4416	geometry dash auto speedhack.exe
2204	geometry dash auto speedhack.exe
4868	geometry dash auto speedhack.exe
4912	geometry dash auto speedhack.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 232	2784	chrome.exe	86
PID 2784 wrote to memory of 232	2784	chrome.exe	86
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 732	2784	chrome.exe	89
PID 2784 wrote to memory of 2188	2784	chrome.exe	90
PID 2784 wrote to memory of 2188	2784	chrome.exe	90
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91
PID 2784 wrote to memory of 4556	2784	chrome.exe	91

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/TheDarkMythos/windows-malware
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd2d6fdcf8,0x7ffd2d6fdd04,0x7ffd2d6fdd10
  2⤵
  PID:232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1964,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=1532,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:2188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2324,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --extension-process --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4364,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5324,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5712,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5716,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=208 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5244,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5752,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4412
- C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
  "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:708
- - C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
    "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4868
- - C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
    "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:3472
- - C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
    "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4416
- - C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
    "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2204
- - C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
    "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:4912
- - C:\Users\Admin\Downloads\geometry dash auto speedhack.exe
    "C:\Users\Admin\Downloads\geometry dash auto speedhack.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5012
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:5112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      PID:1080
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:3984
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd18b7f208,0x7ffd18b7f214,0x7ffd18b7f220
        6⤵
        
        PID:4764
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1776,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:3
        6⤵
        
        PID:4964
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2616,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
        6⤵
        
        PID:4620
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2228,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:8
        6⤵
        
        PID:4148
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3508,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3516,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
        6⤵
        
        PID:5280
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4192,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
        6⤵
        
        PID:5360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4256,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
        6⤵
        
        PID:5368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4212,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
        6⤵
        
        PID:5612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3680,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
        6⤵
        
        PID:5840
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5084,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
        6⤵
        
        PID:5952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3740,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
        6⤵
        
        PID:5336
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3540,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
        6⤵
        
        PID:5344
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
        6⤵
        
        PID:5676
      - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5352,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
        6⤵
        
        PID:5824
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5288,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
        6⤵
        
        PID:5452
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5696,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
        6⤵
        
        PID:5236
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6220,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
        6⤵
        
        PID:1352
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6196,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
        6⤵
        
        PID:4544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6564,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
        6⤵
        
        PID:4048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5080,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
        6⤵
        
        PID:5356
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6568,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
        6⤵
        
        PID:6100
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5648,i,11379189126967913373,10750587199099533449,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
        6⤵
        
        PID:5428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
      4⤵
      PID:5480
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+create+your+own+ransomware
        5⤵
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:6064
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd18b7f208,0x7ffd18b7f214,0x7ffd18b7f220
        6⤵
        
        PID:5176
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2904,i,10977644404170902793,9044634305835021541,262144 --variations-seed-version --mojo-platform-channel-handle=2900 /prefetch:2
        6⤵
        
        PID:6392
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1884,i,10977644404170902793,9044634305835021541,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:3
        6⤵
        
        PID:6400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2244,i,10977644404170902793,9044634305835021541,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
        6⤵
        
        PID:6412
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,10977644404170902793,9044634305835021541,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
        6⤵
        
        PID:6576
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3464,i,10977644404170902793,9044634305835021541,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        6⤵
        
        PID:2264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=3460,i,10977644404170902793,9044634305835021541,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
        6⤵
        
        PID:6776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:7136
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffd18b7f208,0x7ffd18b7f214,0x7ffd18b7f220
        7⤵
        
        PID:6236
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1832,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
        7⤵
        
        PID:1008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2224,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
        7⤵
        
        PID:6224
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2552,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
        7⤵
        
        PID:5208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4356,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
        7⤵
        
        PID:5928
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4356,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
        7⤵
        
        PID:6176
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4540,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
        7⤵
        
        PID:3948
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --field-trial-handle=4796,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
        7⤵
        
        PID:7036
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4824,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
        7⤵
        
        PID:7028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5300,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
        7⤵
        
        PID:7048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5384,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
        7⤵
        
        PID:7068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --field-trial-handle=5772,i,10707689700406648921,9865159173529453862,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
        7⤵
        
        PID:5648
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
        7⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        
        PID:6292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffd18b7f208,0x7ffd18b7f214,0x7ffd18b7f220
        8⤵
        
        PID:6776
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1912,i,7945350357694313824,9192649522645173059,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
        8⤵
        
        PID:6188
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2540,i,7945350357694313824,9192649522645173059,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
        8⤵
        
        PID:6208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2092,i,7945350357694313824,9192649522645173059,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
        8⤵
        
        PID:4540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4372,i,7945350357694313824,9192649522645173059,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
        8⤵
        
        PID:1700
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4424,i,7945350357694313824,9192649522645173059,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
        8⤵
        
        PID:6092
        
        C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4372,i,7945350357694313824,9192649522645173059,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
        8⤵
        
        PID:6280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
      4⤵
      PID:5572
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        
        PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --string-annotations --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=5428,i,9219675558474083206,456666965025598066,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:6688

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:1836

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4344

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6484

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3248

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3464

C:\Windows\System32\Taskmgr.exe
"C:\Windows\System32\Taskmgr.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6768

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:5312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
ccbadbbe7b52c83ddaa72b5e5d557aa5

SHA1
e8095ce44b848838af88e699ce7a75928415151c

SHA256
118634ff74143755e5a038894d41870a3d64032d4262b5ddd89896b6e5cb73df

SHA512
e80d39e2b0d0e0220d8dc89c0eea418336256a5db043ac3a362b85a13fdcb911a9ff2f8cb2edabe8948139ed3d5b574ff971aaab24a4e60d66add64061aa11aa

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a813cd949d77e7a8970b0bc773eb2d7c

SHA1
4af5761d1753edd0aab76e72260b11cb0c6da120

SHA256
95dfe9f9c3412e8c37c87f189ee9218cdb48d3f54f31ed9cb2b96b7360afbfad

SHA512
dd4372835b11f7df97e069a218a1636008d3d3f95012a933ae9c8ddc55995ca1a49054bb70724bfacae6d0247cfa1c8c1f4ec1665cb639c8ede864821a7ed92e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
6bf9c7b57229547f501809936de698d5

SHA1
eb9a5e55f916b0c85a9082ec949e72f0f4452ab4

SHA256
aadf09250fe202f15db11fa2f938f83d52c394c379e957149406278e646f3570

SHA512
2f8c3010a8afc81a3587bd57ca6b46f37910fb4078818558269d006ae2fd96cf3e0810ff8d4f8aaaf4db546325f2effbeeff3a2ea17e6916a0df3219e6dfae4b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
30d9382016941ae8e25e549ec88f770c

SHA1
1bbedbae7cb300028d8bc495db32cbe9989762d9

SHA256
79e0072617eb8446474fa0b43472333a9f9ce4b9568b86463a8d6b57a08a6949

SHA512
e03d25d1302ee150483c333f88865e4b396e8e12bfebff45485df0096e13adcaf1b0ab168167eb2c3d6627637046ca8ebca3341d5f25c87479cf1be2d5569fec

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
b980c1a817172ceeabfbfe4f94c2be65

SHA1
ca682f2a660269aa4fdf72bb9ac514acd3fe68bd

SHA256
9f16cad4bbbbbec2c1cec9193b0d37480cbc94b38288d936d3296dce0286e194

SHA512
d541cc85f566181f80ffd527b08927475b71758636fef0465d0179779f01220b14172b08f0df72e1ce2f576214dd41d1cd46ffb4f263b1e1c813ff3353e236f6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
4718a8bd521c955f8e7f9c0e3b0960dc

SHA1
9f5d32165099775c868cd373b2c2cbc1be290508

SHA256
191fb59a1e8bdd2a8df28ccb51f7261f92d8ec10edcc614ae03229b7ed0ae7dc

SHA512
d0e6113ed43f078aeae8fa0046314d622a780d140b4a962ec4e61c2667351b6c96805aa4b05eb95f1754461342749ff65fcdbda3531dc3d4a49314f8cab7e9c5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
11KB

MD5
f35c281aa4cc7dd065bea98146fc0a1f

SHA1
8e09ce89b651faf9583574878dfa299feacb9d86

SHA256
ac064f59af67f411cdc086b8f49c209240223fb350f43a28703353530d95dbdb

SHA512
2c168d52d8e52ae7edf146ae1df604fc0b8ed7b17fb61f9a0f5420fee0de530c311de430761e29de93525bd546fee13f6b84f40ffdbceab4decdaaf945fa2dc0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
551bc1ff735768232613b8bcc8036d61

SHA1
8fee79fd77e866cce53ca9275d414b8280a7afa2

SHA256
0015f9d485913e5a0216dc05a7688e2ac7765dd2e35d546e3469dcd5444df1f2

SHA512
425040a9c145ea9fb47933bfd12939ef245d6be2f3b0fc3d6ba5ffaa8b008202303e1dd288fdf6029451e623e0d6783a586b7e18f341fbed2c5e6c3ecf82ec4c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
9343654892ee7d07440bb07a64899e92

SHA1
768f4fb013eadc1c9fc6d618a6883c7fa55ebd43

SHA256
0a1b449861d653ac6425f376928a3bb142cc85619b7eda4157d7e84e5dff67b6

SHA512
b19e3cdaae638718fc0091e2177ba706918efd7aac48e9683b9580433624f17b17147d281726e717173d2950e52b80f72a2fc5f68c9cdbb1796e01a51dd1c952

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57bd83.TMP

Filesize
48B

MD5
7160ffe717c1996d17fe3552e08a8b8e

SHA1
bae5c2dd49312d8be9e99e111c7bb87c05726bbe

SHA256
a833c15fab00c85c97ff6549e880e6f1c214925433059d4577c5921569f6c0bd

SHA512
30014073f6a5bf14cf561e41eef3f0ffca94ef4506954846ab80b9caaeecdccf5a9d3374af7478d2ab5cfa1f6831f80ac0820c1c62d9ef87c368613b7c37a636

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
0e6dcc88beaeeaf2760c8f48a6891550

SHA1
7f84101f9101fb84156da19e1cd936c378c0c7f3

SHA256
07d2338675969cf67e8960fbb3e020f8980b8251785b76a1214b8ffbc79ece85

SHA512
6b141eb0c1c85cd43867cb2b78e13fd46f9c69bc0b77b3664bdf62b89b78f7183a6c3519cf792e317c492df1db3a3f14f92745e56f7a63d25b9f37a99f51a3ca

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
be42607f3e44eda8a5e321657c148545

SHA1
0d31be03a65508acbbf1e041f4964a10d5d64c62

SHA256
5f73ed765a8023706691ad52b2eccada7d19055ae1554c716058a43feee6da32

SHA512
71a54d79c8539d51d41248d2e8033ba52a776ec60399cc68c04ac99626d1919a7a47746982095fbd0896006b63a665f91e47951b763f448b7ff70e70f3148ded

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
b64a27f9d11860c2e44a99e2cb968a08

SHA1
acde7124c574d3179bd04e58df2d52276549a1df

SHA256
8d6a18c9b0dfad51026e6465b5c23872ab99e8b104ab6a0ad79c698e2b2a13e9

SHA512
d8eb3573c0471927d20f58e1f8ae42a6ed82e05e655f52fbd8edf104f3e61635f8d69bfcf38ff2c6bb6fb45b39a6cb1538057d7680363905945426accb6cafe8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
51405d52ad99f47e1863de7c92f4bdea

SHA1
702fc5ef23a4c69c3dcf3e7b9a251dead2bf3c8a

SHA256
bff179fdc72487ec770d4813a5a0e8c88372404bada416069362a88f349f2a90

SHA512
63edff2f360e47ed526878f27996a82e63639d2059d2aebbc5e7f06e23a84b1d6e6cbe9f22604a9ee8b864df8fc107dca5069c0f6edbe8901b6c3c25399d6312

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
58632cd4cb9800f75201ce08014ce963

SHA1
1a7433cbf950a5843555f9e3ec102d1418754b01

SHA256
419d4d0a508aa6eb642db6465fcd0f893c8d8d0ca704ae17e42bb78040f36571

SHA512
861fcdd7d2f1c188f7629201cd83e7972437451d387dc5e40000a004dc650461e1a2f4ff3c8eb50a63d65dc70a162ce7ded8e8c2da7ad3bd5eb9a6211d2c49cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
d506c4453d600380290b1c282e4ed2f6

SHA1
66617caf41611031456ee31a3be6da71832028cf

SHA256
e8039ebfcc0b71784d9a68d1c3c7351be9cab9e038c949a1e1d232626fe4a9d2

SHA512
6b4e1359a9c11fc2f495a6f6f97d86726a50554f14eea8afdf5ba18fbb45271eb1b299a6019b4e200e42ae70ea3cdb4e8be3c6fb31ed769b1aa682dd8ea23ec4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
7b6f2d8b64d6044c20c3d173871cccfc

SHA1
88ef0deb3b406d971271265109d6b35bad2a5a39

SHA256
21c41c30bf937473b2abc5dafac2e14e7a1cd20e27ef1606263659a64728c2cd

SHA512
4960741087e2bba56700861e9d545e0b82198a2457a4792cfdd5c79164c31ab4e36bb730b8ecb79a0cb4dbe4893b994f1c32f90e4433e54106c34dae4f9d8579

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
fed4ab68611c6ce720965bcb5dfbf546

SHA1
af33fc71721625645993be6fcba5c5852e210864

SHA256
c41acdf5d0a01d5e9720ef9f6d503099950791b6f975ba698ccd013c4defa8c4

SHA512
f9ab23b3b4052f7fda6c9a3e8cd68056f21da5d0fcf28061331900cac6f31ef081705804d9a9d4103ee7d9c9bdb6aa4237987b7e821d2d96cd52da24219e55ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
4013ebc7b496bf70ecf9f6824832d4ae

SHA1
cfdcdac5d8c939976c11525cf5e79c6a491c272a

SHA256
fb1a67bdc2761f1f9e72bbc41b6fc0bf89c068205ffd0689e4f7e2c34264b22a

SHA512
96822252f121fb358aa43d490bb5f5ce3a81c65c8de773c170f1d0e91da1e6beb83cb1fb9d4d656230344cd31c3dca51a6c421fda8e55598c364092232e0ad22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
fc380b31a3aad431c52a07d92cb14611

SHA1
29b9e8616b1a9d62ee8e7c7ff159492090e97a25

SHA256
277d90507b11ba9e4ba340e545cb09e02992f1252b1ba839a576d628b08aae82

SHA512
6da9ad40402785ca41482c2e273a43edb0241830632f8f3e3aee558091dfe0533b369a248233752f55775e909d34280f4d2f2b136d2c510e969f6900853923c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_0

Filesize
44KB

MD5
bc1cf32df994b4a8276a3c557ce7a127

SHA1
11700c23c06d06a10272bfbcbf944468aab11627

SHA256
95952171071ced7c141ecafb8753827bcc2e43135d0143da0cbc25587cf3cdd3

SHA512
9ecb645fbbfaa1c7eae2bf36079e363ff30d8539e2f9083010de6f0bc5538b6ae221b8162c828251215c5a91c0fc1bc10bb79a4a56e43bc8352b47fd35a18337

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_1

Filesize
264KB

MD5
e3b4af9cd5f4cb12c986c76fd3459825

SHA1
65b7d8db55f10e233016ee4f13c3f1ed38a4f8d7

SHA256
396fe110e4f685559198e9ed23e999fc41ba85407cee75e4376e8e1e1b0cac1e

SHA512
873e081911718c90c166adc7971be405e18723a48148a205bbcd3b90807310a9ee0d59b5f783d8a79713a01fc4a881b4fa0bd4fa67d3096b14ab2ec0cfe9b57b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_2

Filesize
1.0MB

MD5
55b2232547147f4b97b57d0e70cf832d

SHA1
bf59998a49691886c5bd0d2852f7e0251517634f

SHA256
92a8d0026884c4782bdb7d7101c7334f10b6181df47b4780eb45d4265c733161

SHA512
7ba1c3a08a43bb2dabb0735306b7211f92b4529bf44d291df7d1561b13213e8d898dcdc94933992006253e44adc9ce4f518f8e8060c0c12106ea4ea297b98b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\data_3

Filesize
4.0MB

MD5
357b5a6b5e4c6b52710986a1a29eda0f

SHA1
92e905d7f555d2710335643e72896df9384a35ae

SHA256
6b820408bc9549df99c963aa0c7d744b691e6d04c0255f27e62bcd4244e49124

SHA512
aae5e37fbbd6b961f078b786fc7ec8d7e532b7e9166131adf655c4555c58a30d616f44c62fae00d894e6cb9175e9ff9a646e6bf0cac2d02270ed300fc321aeec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e

Filesize
215KB

MD5
e8518e1e0da2abd8a5d7f28760858c87

SHA1
d29d89b8a11ed64e67cbf726e2207f58bc87eead

SHA256
8b2c561b597399246b97f4f8d602f0354a979cbe4eea435d9dc65539f49cea64

SHA512
1c15b65bd6b998254cc6f3cbef179c266663f7b1c842229f79ff31ba30043837c398d85296fb20d3a576d9331fee9483ca0cbd06270da2d6db009bc454aee0c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
a635285f7f017a11908cd0e99d547867

SHA1
c6ebf278dcde098ed6d0c60cc6cb72bee969b4d0

SHA256
c0758f5931daafd357706fe6c59bf4bc81e478f0fdffb2dc82b92ec749eb8589

SHA512
4b1c4c1bcd3d25f7fe12f7e0b2c5c3236eece0e88c52689d42d9041d28c6c60db4e849fb70abe4c1f498f097c7702d43c302990dc35485c6939e22b0fc4362e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
5413a61695a5d4c32ab5a0680074b166

SHA1
6d60e29255dfba9bf58c084f69c575083c825ef3

SHA256
9ffecc565d2637c9a8ef48c408f2358cf970e9f30af305ca2cd61f398b497d6d

SHA512
0537c2f9453df1f0775874370cbef5c3e670fd04cfd91e0ee2c1a64133709bddc618b70d91194e2a33a675a58527088cfd9467b2b341da88c212e643d9044eef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3c8deabf77f1bd00e1244f973cfad89a

SHA1
c4e8bdf917f19c7a51fa5f41d19701e1677e7b30

SHA256
bee492cc8c27562eb4d8d26262b99fb88e74493cb9a11ab9784e48a3a4c496e3

SHA512
7648114ff2aa71a5f159746b15369d2b645e28618946a285de6c63e3dfada9d1755f7db24aec68a3582611c54b6b9f937ee3f186672af65b27af4bddd161f51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b87d.TMP

Filesize
3KB

MD5
5d23a0c3927d9631639067f22699911f

SHA1
5668165615735d84b8821abd2c0b035bb1ee2b13

SHA256
a38efa835214aa75032658c748989f9df487ce2ca4f221f2db018a79d2064067

SHA512
a44c700f1c4179297ceafa8113967c2bed64a62383739c00db24292967d0daf3a0e2be3f80a38b46d3d54a86c9185f18b99e9cb865a981b99cc22d433e394d3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Filesize
429B

MD5
5d1d9020ccefd76ca661902e0c229087

SHA1
dcf2aa4a1c626ec7ffd9abd284d29b269d78fcb6

SHA256
b829b0df7e3f2391bfba70090eb4ce2ba6a978ccd665eebf1073849bdd4b8fb9

SHA512
5f6e72720e64a7ac19f191f0179992745d5136d41dcdc13c5c3c2e35a71eb227570bd47c7b376658ef670b75929abeebd8ef470d1e24b595a11d320ec1479e3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\verified_contents.json

Filesize
1KB

MD5
738e757b92939b24cdbbd0efc2601315

SHA1
77058cbafa625aafbea867052136c11ad3332143

SHA256
d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947

SHA512
dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\content.js

Filesize
9KB

MD5
3d20584f7f6c8eac79e17cca4207fb79

SHA1
3c16dcc27ae52431c8cdd92fbaab0341524d3092

SHA256
0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643

SHA512
315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Favicons

Filesize
20KB

MD5
bd11ffb5af989bee16805bbe9b9ece22

SHA1
7330917c417fa42d6626d6760b06c09b220b58c7

SHA256
417a3b29654bfff5513fc40a719be97607a650c2847310c927132cd29aac75a4

SHA512
8783757c0688548774d10157db9747e6ddd5e62dc8a815d4af67edcfe139a57868e8feab79765702a2bad1ea77466cda5b4e0aa02a6f967e5016769f37e67a3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\History

Filesize
192KB

MD5
71164458ad36112791e6e772fe78d65d

SHA1
f2699cf4d20905851af2393d70b4b54d969e5ae1

SHA256
1c9edc4bdeaa639e8764464e7fff90540d2e58b24182a0e627a363f45e85bc5f

SHA512
76e3fe077ea887c8debd7566732ab5f5cab843d884e82f29a1d90ff165507cfd02040a3749a780f6302fe75b0b6f94cf02e00557a6aa1ec64c2f41fc00e48638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\66284238-154f-40b4-8ce0-89968dc59a9e.tmp

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
235e8a074e1069b438473f32424e9782

SHA1
084ab6e43fa52d4d2ee8d0871f1867e90dfef344

SHA256
8ff636733daa25aa28ca5a7cb97572aac10e376da24afd9b945701ebe491a08e

SHA512
f5179bbfffefe1d094440a2271372f80be3874961ab60a85e54a29a2c23c7fc6c860fd685fa3143751c13a112ce905f541cf6ff034a1dc50db48c81c5253fd69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
5026abe80cc56f2c48ce4cdc1e884d43

SHA1
72db442e55d2215d7a235152cc2f0b7a75b9282a

SHA256
845c9d490c47788adddb8973afc72ddd6515fb2678c05519e6c6f43be06592bc

SHA512
4d1f82eb5a6bfad44f1c54016a88e60787330c5db5e19deaee46d12501c710b353fbd4c11a971c2bf0adf91730529f7a9fc774060d9e419bb56864f8276ba82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
56cc33ccdaf6b9bc3efbc2da254ae90f

SHA1
6f022c46b479fefba8c5b4dc3128a0f403eabb1a

SHA256
9426fdb04a9cdd442234ed19538ef7284d4938983135627abd066959c40fde2e

SHA512
cddf6cad8bde6d58d402570f71068e0968c0406c236b51c9b6e9530c3493c38c942f6ae12f05095dd1fb7019dd664d0c212207b6a628fa2363b297323b1e4428

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
f7adf1272711315746ee56df2fc6dcc7

SHA1
9f59b60e5fa32eddd9cdc5b428727b76a5b0d56c

SHA256
1919b229a76827907f6e9af099cb10eda69568da823bebf289d6fa00dcb6668e

SHA512
4ab5285ae0d832eb55a91f7c082d50d8b167746d010201c60409cb32783b950f1eda07af37c02fe5bc637e6f1677c0efad36fe04b307b55633fcbbedab327cfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
1d391183788d913175f3efdab9526d70

SHA1
f5917b764586015bd99b0f9ae2e8dcf6d5b11406

SHA256
77f42fae7bc7e665b0ba09fcf3e31019db9c17428f90bf42af06ad53870ca6ce

SHA512
c68db0ab227451bbebff0f68be386834e12890ce0aeff28111f0315963b1001cfc3c21a99fd5a00af3ff37d8cb0b3bded511c74f8bf27a50422a842e6fc7ce96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
14KB

MD5
e0dd306ba76be638d2c387183a024c5b

SHA1
50fb228d86ac993585bbe0fe734cacb0f8d51c0f

SHA256
39de727914aa4d278faf99ac20bedbd9841fcc63658a1e66e29c768a763ce54c

SHA512
10b7ab95874982d888f9ea7b57d9ba435ba69e1d92ccdf45b76c1fec9e0a04dca87be3167a2d15e75f92f56dfaef00d27ba2b67775fcc87191615a9051ba59eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
15KB

MD5
0e96c5cdff0ef4d380252f7a4597208b

SHA1
7a6fca7dd77eb75f0264978bdb5a9226c65db5ca

SHA256
94fa7a4e0bf0024d39e9e3a316c0ae68afec5263a9d2db69fab5c7ce8e71b179

SHA512
9de1aaf1e6432622e13b6424de9c497ea6f1fdc63ed5093894d4b3f06a867f03e3b0554ad28bd9575a37110cf3f2afd508731c49b053773d9cb8375afcf367f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8fc18c9b29ee0bd3dd165eb32b46785c

SHA1
a8674689b737f44a9e32568185b2c8de94af6618

SHA256
03375cef167a0976b9316ded08f9e3b47c1e858080216c89d54878897bf3b191

SHA512
4ca9453cc1029bab0e089bb954506b16d537ab42c1fcb9977880be617cf223bbf24797a84c1903341723e796458d996f0c40377c00bb59c11ac0ef8787e1aa25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
36KB

MD5
df289e06f144aa1f795be8d4522879b9

SHA1
548e9612fe9e79cdafbfe6ba440daff149d2611b

SHA256
88ac3da9d20771c2914776edccd009037884eb66e46938a5f4aafb0e398b30c7

SHA512
6c93699946c8f80a2fee543a8b4e6a8b4a054bb95a5dac69a69f73df80a5bb3adb472dfacac02d8b547404524ea73b9956b9afd74849fedea2a7a7b8ac45cb94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Filesize
335B

MD5
4fa1c4524b3f22042d7be8c930139304

SHA1
59f6a8dc88973e2d60962c176518f447889c0059

SHA256
84c498ed793df071444bccea93954dcb0eb9a947202dc41a6cf389e953091b2e

SHA512
c243120ef5a83d89c5799c379026ba7f4bba35a60a7afe2e951314fad1725397ded9e08b6e1dd9617e608da67b4b69273719fb43f65eb86b61b0ad8756c26eca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Tabs_13387404842792301

Filesize
1KB

MD5
910e78165abfedd76f396d37df6cce3b

SHA1
2f7f1366db5c6bacedcf1789a9d7aab656feae74

SHA256
e118f1faf5d44f7d015f864135bf05aab1d4e331d81d0708e86e610f7d5d158e

SHA512
0d53454d412592873630ab506b37b8e1b1ee0b9412e1412d0ab91f1f06e0bdb08d2907b4ee3a0f6450a891a35913b084286bb9f38f5fd2739db21491f9290dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Filesize
112B

MD5
44e67314b875c0d972f51054e59f3fca

SHA1
4dac4a10292d5472ac5e1d136d18581bd061483e

SHA256
7737f559ac68dc97a914d17d3e0a0cd18bfdc5b1d3155a37c807f016f22d9cc3

SHA512
49a5f015a1ce385ffcfc9054046ee09979854fe5cffdb7a3bb8f9f2c328e3e4a305b5b9fb5ce2aab182c594aab1e60ae94465eaf92dc56629918b23104ee68d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Filesize
350B

MD5
f169b425ef8ab3c52ec42c3b924f9aea

SHA1
6a269901ba5553463169923e725218a2c4123490

SHA256
4cfe44aac21a50ff0a92b6e4acf58962b7dd46108c18f3a39208836a7f08b65d

SHA512
b0ec83f72374014237df75495400205bd3e6be0d83b90f8d400fcfa915234a7447ed78f98e3c9b6d5e3d4a4143315452ab3d8dfd303c3bfaa1bafe1cd2e32fc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Filesize
323B

MD5
caa5806a5cb12cacd76a421113c5b2f4

SHA1
0ef6c63c3d28ffc4672c49ce5586dc5f737538cc

SHA256
78380dca05afabe3fa4ea9e3bc1712178cc466ba1484b6df2034cbe8ab9bda3c

SHA512
208c56f672743ed373ebc2a5b978dedf8a6010da0089e6403413a4da364bfe4d45559348f04519865a1d23327af40b440aade60e95f2336a958cbe61f481238f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
4KB

MD5
23438ebf6d1f42945a13d9b9cf26c1a4

SHA1
ff6666327e9ef6d1f7d5cf09a0025e6140dcce08

SHA256
e12cdd44018360560084857d225efe497113e8929c4e980fa1709b658781e6a8

SHA512
058c1442eb948d9b321e339ad40ef76ef04d7e2dba90416d91a5e0d13363ba9f10e75ddb6b8bf9770a46fef1b8a79e5caf0828ecd2cd99df7091104c819db84e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Visited Links

Filesize
128KB

MD5
56081ae18dfd175cb2e26cdaa37d7d9d

SHA1
aca98d93142727486731c102006ed54c193fbe23

SHA256
72d98ef91864bcf5a6fda4e968a39b9e74622b9c2325fb1918d8312aaf057b18

SHA512
72b4bf7241305db8c0812a2b94c8631dedc3e6e3f7169acaf935ee77945859db3e4e74f6831cdaec56ccc54e2f6c28698b272184ef42513725a167ec91424522

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_0

Filesize
44KB

MD5
74666c4b943409e74732f68a994a9e77

SHA1
72db1bcef139b0494b0c76fd11ac82f71f40ee9b

SHA256
4e5f0c59bbd57b00b5fc5461c648fe837a390926212dadb5f4e3130c488c29da

SHA512
e13a114b30128ba3f9c37e67c71faa8bd6c5b71a2dcbb6b427b078f80a63832ac89b42d99a5e095a0039db51722cce05bf53b8291dddc9edb9c9b1a0a62aae17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
bc26574ad15daecae15a371bc139fcb9

SHA1
c3f2d926b9591ab10c6caf88d91d001fad8ef7bd

SHA256
cd1b17cea179ac47c9da5fc6f0b2a2c41ec0946de8df4a592ac9d70c00fba9ca

SHA512
e57b062bea5414db3a32fd31d0da1371f8d9b051bcad150b107578da04482491c5f69d2958cc35f7e14899563cae0dd3306ee066bda5ecd2252b197f5c450b97

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
13B

MD5
3e45022839c8def44fd96e24f29a9f4b

SHA1
c798352b5a0860f8edfd5c1589cf6e5842c5c226

SHA256
01a3e5d854762d8fdd01b235ce536fde31bf9a6be0596c295e3cea9aaf40f3dd

SHA512
2888982860091421f89f3d7444cacccb1938ef70fc084d3028d8a29021e6e1d83eaef62108eace2f0d590ed41ece0e443d8b564e9c9a860fc48d766edb1dc3d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
30KB

MD5
930dd6df9850e05cbee2d4906cea2338

SHA1
128db027911af9c2f095bca9f214dd59321ef333

SHA256
2b6576e35b69126a7671d5c9202bea257c885a319dc173a7a582d1eda8191238

SHA512
8d985b3a9841e69e02f12d2cebe929823ae02cf8e57e26127a585053630c5dec42d5cea5263255cdc6075aeb281cbc88a9bb868957cd2e4848fb825d532ea298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
9d3021cd1b0e0ad24ca30b19fb29b52e

SHA1
f22148312b6e9a72d73f76b3973f534ee14ac2c3

SHA256
2cb4262203066553edf8208b5c9710e61e9d31575be5191fcc8e5b7194efb335

SHA512
52e917c898b244bbee589df78ea589816fc756ed25a334cef73f62fb96a79fce9176208d71c813843164303f0bc71522b701aac830f5e3dc6e441b77acc65aed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
36KB

MD5
9ac0c6cf16cf40dda265e70b80d8e344

SHA1
ff502f4ebbdf72bb47bb00312ba508635ca067ae

SHA256
87d25a9f5634ca29a5adceefc9ba8936c41935ddf21959586e1010e3412df587

SHA512
427f51ca77d554b75b1706657b0f192789a7cd5492fbe07c2672de8c91484c8f4e2701192f5ed0edb539880f01d48ce9c0d5ed25c5ea822925fd6f75305a1c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
afd1afe2f1db28c0eec90294fa522592

SHA1
48d899fd51af25acb43d5602a8b399e53c3acf9a

SHA256
4ca160d70aec2210d6352344aee75fa8f4d897c6161559b9b41f6e7d14b35047

SHA512
ea180282a293f1de3df803f2fd6ae31f6d26a4eda22a609b8085d56b7c79a2a1fad65097a8068c5a311026b58720346c63151ee24fa694f8f7bcb5f097659142

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
2a812cf67b7e71ab6b983b3eb21d2e53

SHA1
63fdf9b1f91126729b7ff16d5a750a4b8e84a2e0

SHA256
67c35e9b0781efefc7553c10dea2396c9887490a335bdcbf20621cdad2fa62ed

SHA512
767ade58693a3ceb959fc8b52fb21526f5c5b1ed11b106d628f5c1eda0debb56d34c4218d8a3672ac08df31bf0264225209dfcc231e7c0f12a2e812a21336d45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
40KB

MD5
da8819cbb50374e7447254ea6ce22d6b

SHA1
a6c942a2de600a10d715f6682869427d02fd34c7

SHA256
bcb3c3f3554787363a67bf0f389b0e95ef3cb1d6a40342c0f9e7eafe7a10b2b5

SHA512
538095dfe40e12a873d4c54556121d670296e096f0fc1a31ef4243dbb22a7359affe34b95e5517720a454ef24d2e005c8dcdd93e00867882d2f81751a6cc9380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
aecc2eae3362aa6a55e22bed5f2a6e0a

SHA1
d0656425847d85359c4f271ded029444b3131f82

SHA256
eb79f03abb2f1742314ed78e008e38bc975cf4021a240676f5db156e65843267

SHA512
90dbbbb7fa67894814f8f79094d6834733f348ff26b17ca2cab00c4b031dbecf251eba77e5e71a9be1bd20455ea155dab7f40dd5bd458a02d3e93150c6950dd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Variations

Filesize
86B

MD5
961e3604f228b0d10541ebf921500c86

SHA1
6e00570d9f78d9cfebe67d4da5efe546543949a7

SHA256
f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed

SHA512
535f930afd2ef50282715c7e48859cc2d7b354ff4e6c156b94d5a2815f589b33189ffedfcaf4456525283e993087f9f560d84cfcf497d189ab8101510a09c472

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Filesize
2KB

MD5
a6ab1454f15fa5aadf915261b6c4e2cc

SHA1
fc1a41dcb91d326124b93a120584396365049b57

SHA256
a41f1ea437345fcfb74a7a10ddd6850d0d87083d207e02a9e61281f45baf6d5f

SHA512
489080843ce6923d61a205edb510300988ed57244ca412211f4bae306918fb50821f4e57397eebbdcccb506a170ce0d22359b2bbd8f6c12c15f31c66df020c1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\85b77bbc-6ba1-4a6b-8e51-0014d37c64c2.tmp

Filesize
10KB

MD5
78e47dda17341bed7be45dccfd89ac87

SHA1
1afde30e46997452d11e4a2adbbf35cce7a1404f

SHA256
67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550

SHA512
9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\c8ec518d-4773-4205-86ce-07d2041fa99b.tmp

Filesize
1B

MD5
5058f1af8388633f609cadb75a75dc9d

SHA1
3a52ce780950d4d969792a2559cd519d7ee8c727

SHA256
cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8

SHA512
0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21

Download Submit
C:\Users\Admin\AppData\Local\Temp\scoped_dir3984_571795521\0d8cf33a-c6cb-4c52-a06f-dd10b0649d80.tmp

Filesize
152KB

MD5
dd9bf8448d3ddcfd067967f01e8bf6d7

SHA1
d7829475b2bd6a3baa8fabfaf39af57c6439b35e

SHA256
fa2232917a5656ea4f811936561ea6b7c92b3c0004c5e08ecb97636d3afc6f72

SHA512
65347df34378c2bbb34417e2cccfb3251a0b2412422cc190eed9df525b6e0a9948e0295ea3c33b3ad873ce81e369e89a138ac41d6eb7229546c3269107e661de

Download Submit
C:\Users\Admin\Downloads\geometry dash auto speedhack.exe

Filesize
14KB

MD5
19dbec50735b5f2a72d4199c4e184960

SHA1
6fed7732f7cb6f59743795b2ab154a3676f4c822

SHA256
a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

SHA512
aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/6768-1343-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1344-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1339-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1337-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1345-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1338-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1346-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1347-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1348-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download
memory/6768-1349-0x000002A2A0860000-0x000002A2A0861000-memory.dmp

Filesize
4KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads