Analysis
- user interaction
yes - max time kernel
561s - max time network
557s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
20/06/2026, 04:16
General
- Target https://www.mediafire.com/file/vnrajypnxyor1nx/888_Rat_v1.2.6.zip/file
- Sample260620-ev281set5z
Score
10/10
Malware Config
Signatures
- Family: 888RAT
888RAT is an Android remote administration tool.
- Android 888 RAT payload 2 IoCs
- Downloads MZ/PE file 1 IoCs
- ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 7 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- AutoIT Executable 8 IoCs
AutoIT scripts compiled to PE executables.
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 34 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 51 IoCs
- Suspicious use of AdjustPrivilegeToken 12 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/vnrajypnxyor1nx/888_Rat_v1.2.6.zip/file1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x234,0x7ffc4dd8c188,0x7ffc4dd8c194,0x7ffc4dd8c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,9006846812710032419,17145837510436152422,262144 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,6892693891991030912,2266115299728095280,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,9534391260798029470,731245035398289206,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,1143398858698927799,3042394173740064046,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,14136947587965752743,15190364879252877728,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,15859156811529514482,17805857820733899497,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,13705842991923163117,10054954412342109515,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3676,i,5275431742910820448,15267142232873354041,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5208,i,8803157580597204332,4225554007153594507,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,11121538493212155240,3476531990489853133,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,4652996303651278124,13720981402527096512,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5908,i,15259200787801826700,17681924453450265910,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,4335283024300757442,3692677808194185876,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,4335283024300757442,3692677808194185876,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5148,i,14577821565899708681,13341733680554362120,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5088,i,6511185870105827989,5701743926890799391,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6980,i,14223012319275834133,2622676065810821010,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7080,i,445317850031996747,10312770170669306060,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7220,i,16715685415978110468,7523161469910551540,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7184,i,15629012572534389776,797102858498337807,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7524,i,4338455767351982109,4178612968779495815,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7840,i,282668479442397374,3227196411937463203,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7828,i,14424927016454580440,6194100416144859860,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7680,i,12423075555029929512,8860961226233581910,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8176 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4320,i,14255802087034613945,7534093721551385620,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4580,i,13067820955475201573,15189056728556811504,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7604 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7008,i,11686000165458065505,14037847109477013433,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,6344977965256217313,14837406913322378421,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7560,i,3120161302684602050,17604105165630490574,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8132,i,1723473604540888267,5958975374622336730,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8184 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7024,i,4343467399261589986,7415479403583615963,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7464,i,13348366298500669701,16453508021292955965,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8600,i,413175195331432268,10228873386316554984,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8660 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8552,i,10204341545260623950,7637574311112908545,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8620,i,1677503289948379098,8409849236155837259,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=7024,i,9912654059967900531,7448622550464863540,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8740,i,14812893939478911914,700496029121679812,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7088,i,3181735326114498443,8165997819094624652,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=8780,i,3933140398365976112,4027062187131489168,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\7z2601-x64.exe"C:\Users\Admin\Downloads\7z2601-x64.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\7z2601-x64.exe"C:\Users\Admin\Downloads\7z2601-x64.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8100,i,7452934400452981172,1277508270873776279,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7996 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4008,i,10808204083896230466,14092432280519594538,262144 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8872,i,9873665516437212127,10031006746419689395,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=2720,i,7841738548230010781,13944192888687854241,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=1216,i,12115129124309944271,18431898187691464104,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --always-read-main-dll --metrics-shmem-handle=5316,i,5828269956409772789,8095014525275630023,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8896 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=8980,i,6508960808809225669,2108421673785616522,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=8988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=8548,i,8637910854582794494,403814619294055934,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=3912,i,17529337966651466032,573739926956224579,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6756,i,9532914022264204647,17600011228794328918,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9224 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=9372,i,1401993341976428115,53317631140918947,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7964,i,16875797033755672546,1109044525323732832,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8912,i,14567866306818845277,7201083951125924075,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9628,i,7145982465900262294,5928451701280090471,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7740 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --always-read-main-dll --metrics-shmem-handle=9512,i,17338263299481217571,18234895538560189675,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=9240,i,13144398078902769987,6302051282351536372,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9248 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --always-read-main-dll --metrics-shmem-handle=8916,i,9831040280095285116,18243488869577173307,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=9552,i,8320927099775258397,14302654203862451997,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9348,i,16565544444465687711,3455295799981878262,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=9704,i,5300500706752192220,12336355470240603967,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=6300,i,8550138769731088592,600445892394076987,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=9512,i,14193618713640047171,3048090163177394129,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=6300,i,13430066093687369797,5836053571701127683,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7932 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=9604,i,17920851293502621721,13217846143952021928,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=9136,i,11216859689182249120,11973416521465727698,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9848 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --always-read-main-dll --metrics-shmem-handle=3372,i,261838622549015457,6885687182919006108,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --always-read-main-dll --metrics-shmem-handle=9172,i,13170793248691571325,17764996587727413876,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=10048,i,18190578482690833972,6247565404379896229,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=10064 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=10044,i,2147937153830930176,13438864630166029368,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --always-read-main-dll --metrics-shmem-handle=9172,i,12128560515641620890,13782546030976347713,2097152 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9152 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9220,i,10690809181570808570,14839107094922928950,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9548 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8064,i,14566087937446139141,9515612514421383005,524288 --field-trial-handle=2416,i,2238860972473221007,1660188560016558060,262144 --variations-seed-version --mojo-platform-channel-handle=9660 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\888_Rat_v1.2.6\" -spe -an -ai#7zMap15339:90:7zEvent2301⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\888_Rat_v1.2.6\" -spe -an -ai#7zMap28004:90:7zEvent112311⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Downloads\888_Rat_v1.2.6\888 Rat v1.2.6\888 Rat v1.2.6\888 Rat v1.2.6.exe"C:\Users\Admin\Downloads\888_Rat_v1.2.6\888 Rat v1.2.6\888 Rat v1.2.6\888 Rat v1.2.6.exe"1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\flagx.exe"C:\Users\Admin\AppData\Local\Temp\flagx.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Start s.exe2⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\apkx\s.exes.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c javaw -jar "C:\Users\Admin\AppData\Local\Temp\apkx\apktool.jar" b -f -r "C:\Users\Admin\AppData\Local\Temp\apkx\888"2⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Java\jdk-1.8\bin\javaw.exejavaw -jar "C:\Users\Admin\AppData\Local\Temp\apkx\apktool.jar" b -f -r "C:\Users\Admin\AppData\Local\Temp\apkx\888"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\brut_util_Jar_4612108398125759928787602363241447099.tmpC:\Users\Admin\AppData\Local\Temp\brut_util_Jar_4612108398125759928787602363241447099.tmp p --forced-package-id 127 --min-sdk-version 14 --target-sdk-version 29 --version-code 1 --version-name 1.0 --no-version-vectors -F C:\Users\Admin\AppData\Local\Temp\APKTOOL2944424389580290398.tmp -e C:\Users\Admin\AppData\Local\Temp\APKTOOL9221858494852612779.tmp -0 arsc -I C:\Users\Admin\AppData\Local\apktool\framework\1.apk -S C:\Users\Admin\AppData\Local\Temp\apkx\888\res -M C:\Users\Admin\AppData\Local\Temp\apkx\888\AndroidManifest.xml4⤵
- Executes dropped EXE
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c jarsigner -verbose -keystore "C:\Users\Admin\AppData\Local\Temp/apkx/888.jks" "C:\Users\Admin\AppData\Local\Temp/apkx/888/dist/888.apk" hhhhhh -storepass hhhhhh2⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files\Java\jdk-1.8\bin\jarsigner.exejarsigner -verbose -keystore "C:\Users\Admin\AppData\Local\Temp/apkx/888.jks" "C:\Users\Admin\AppData\Local\Temp/apkx/888/dist/888.apk" hhhhhh -storepass hhhhhh3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\Aut2exe.exeC:\Users\Admin\AppData\Local\Temp\Aut2exe.exe /in C:\Users\Admin\AppData\Local\Temp/PVOMOH /out C:\Users\Admin\AppData\Local\Temp/XYCZKD.exe /icon C:\Users\Admin\AppData\Local\Temp\ssc.ico /comp 2 /nopack /Unicode2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x240 0x3d81⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\888_Rat_v1.2.6\888 Rat v1.2.6\888 Rat v1.2.6\CPTPWY.apk"2⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\888_Rat_v1.2.6\888 Rat v1.2.6\888 Rat v1.2.6\CPTPWY.apk"3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2020 -prefsLen 27099 -prefMapHandle 2024 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {76a6f010-c4ba-41d5-864c-793ecbc88d37} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2368 -prefsLen 27135 -prefMapHandle 2504 -prefMapSize 270279 -ipcHandle 2512 -initialChannelId {5e1edf47-7945-491d-89db-cab34a1581b4} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3680 -prefsLen 27325 -prefMapHandle 3684 -prefMapSize 270279 -jsInitHandle 3688 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3696 -initialChannelId {c74c105f-1c0a-44dd-af28-9fc471960486} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3872 -prefsLen 27325 -prefMapHandle 3876 -prefMapSize 270279 -ipcHandle 3684 -initialChannelId {5c6ade64-debb-44c0-9701-c7f0fde54ba7} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd4⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4400 -prefsLen 34824 -prefMapHandle 1644 -prefMapSize 270279 -jsInitHandle 1672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2984 -initialChannelId {214dbddf-c710-4b2e-ab15-ab260a80b60f} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 5172 -prefsLen 35012 -prefMapHandle 5244 -prefMapSize 270279 -ipcHandle 5316 -initialChannelId {4607eb99-5cb9-49fe-a695-d8137895de8c} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5432 -prefsLen 32952 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5440 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5448 -initialChannelId {256ca2ae-fd2d-4f67-bf6c-8abf88673241} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5664 -prefsLen 32952 -prefMapHandle 5668 -prefMapSize 270279 -jsInitHandle 5672 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5680 -initialChannelId {82238a30-9091-482e-8be4-0d24ba44f6a5} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab4⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5796 -prefsLen 32952 -prefMapHandle 5800 -prefMapSize 270279 -jsInitHandle 5860 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5868 -initialChannelId {2589a7d9-7529-49d3-a15f-8ec565fb9625} -parentPid 1620 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1620" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab4⤵
- Checks processor information in registry
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\CPTPWY.apk"2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- System Location Discovery: System Language Discovery
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D32C1531379EDF1D419BE3C2747F0F17 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=57E93AA419B3D3EB80F167C8BAEABB41 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=57E93AA419B3D3EB80F167C8BAEABB41 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:14⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=814616BE0E3DB6270F40D6AC094F4BEB --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=590B028CE3899B98FAE6D8E9DFDF6F81 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8A42745D254C3232F4B8D2E2E6D4DC8A --mojo-platform-channel-handle=2396 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
- System Location Discovery: System Language Discovery
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
7-zip.dll
7z.dll
7zG.exe
autB74E.tmp.exe
autB74E.tmp.tok
blocklist
settings.dat
settings.dat
settings.dat
LOG.old
BookmarkMergedSurfaceOrdering
f_0000a7
f_0000a8
f_0000aa
f_0000ab
f_0000ac
f_0000ad
f_0000ae
f_0000b0
f_0000b1
f_0000ba
f_0000bb
f_0000e4
f_0000e5
f_0000e6
f_0000e7
f_0000e8
f_0000e9
f_0000ea
f_0000ed
f_0000ee
f_000106
the-real-index
the-real-index
the-real-index
the-real-index~RFe59287d.TMP
SiteList-Enterprise.json
Edge Profile.ico
HubApps
CURRENT
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe58f066.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe589ff4.TMP
the-real-index
the-real-index
the-real-index~RFe5aaceb.TMP
index.txt
index.txt
index.txt
temp-index
the-real-index~RFe58f548.TMP
a8e04fc5cdb1ae0c_0
the-real-index
sync_diagnostic.log
f083b54a-4404-4680-8b11-4109f37605e5.tmp
OperationConfig
OperationConfig~RFe59408a.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58be3a.TMP
data_1
b5385198-8847-47f2-bff8-874df4f25795.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
166.mp3
8x.ico
Aboutx.jpg
2.gif
3.gif
4.gif
5.gif
6.gif
7.gif
Main8.jpg
Server.au3
Splash8.jpg
888.jks
AndroidManifest.xml.orig
abc_list_divider_mtrl_alpha.9.png
abc_ic_star_black_36dp.png
abc_ic_star_half_black_36dp.png
abc_ic_star_black_16dp.png
abc_ic_star_half_black_16dp.png
abc_ic_star_black_36dp.png
abc_ic_star_half_black_36dp.png
888.apk
888.apk.apktool_temp
androidx.coordinatorlayout_coordinatorlayout.version
androidx.lifecycle_lifecycle-livedata.version
androidx.vectordrawable_vectordrawable.version
abc_list_divider_mtrl_alpha.9.png
strings.xml
apktool.jar
s.exe
autB546.tmp
autE538.tmp
flagx.exe
--.png
1.ico
12.ico
13.ico
14.ico
15.ico
16.ico
17.ico
18.ico
19.ico
2.ico
20.ico
21.ico
22.ico
25.ico
27.ico
29.ico
3.ico
30.ico
32.ico
36.ico
37.ico
4.ico
44.ico
45.ico
46.ico
47.ico
51.ico
52.ico
53.ico
54.ico
55.ico
59.ico
6.ico
60.ico
61.ico
62.ico
63.ico
64.ico
65.ico
67.ico
68.ico
69.ico
7.ico
70.ico
71.ico
72.ico
73.ico
74.ico
75.ico
79.ico
8.ico
80.ico
81.ico
82.ico
83.ico
84.ico
85.ico
86.ico
87.ico
88.ico
89.ico
90.ico
92.ico
93.ico
94.ico
95.ico
96.ico
97.ico
Andx.ico
Winx.ico
clos.ico
conn.ico
exe.ico
x1.ico
x2.ico
x3.ico
x4.ico
x5.ico
x6.ico
x7.ico
mon.jpg
skin.888ww.msstyles
upx.exe
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
data.safe.tmp
data.safe.tmp
events
0eba52c8-7413-42c7-9e23-c37cc1f325bf
74c17612-aad2-4bda-89b4-dbe8884d2b3a
9286dc5f-c915-4634-9895-816e281297fb
a5e570e6-b6ab-4027-be09-93d679855bca
d3ee7ccb-724a-40e1-b9fb-fcd2aaa18e9c
f43677b2-0855-4bc4-b717-c85bd112b222
prefs.js
prefs.js
prefs.js
prefs.js
memory/5588-2891-0x0000000075CF0000-0x0000000075DCC000-memory.dmp
memory/5588-2855-0x0000000075DD0000-0x0000000075DF5000-memory.dmp
memory/5588-2912-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2907-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2906-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2905-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2904-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2903-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2933-0x000000000D5E0000-0x000000000D69B000-memory.dmp
memory/5588-2881-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2853-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2882-0x0000000075DD0000-0x0000000075DF5000-memory.dmp
memory/5588-2883-0x0000000075C10000-0x0000000075CE3000-memory.dmp
memory/5588-2885-0x0000000077290000-0x000000007733F000-memory.dmp
memory/5588-2886-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2888-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2889-0x0000000075C10000-0x0000000075CE3000-memory.dmp
memory/5588-2887-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2851-0x0000000075360000-0x00000000753DA000-memory.dmp
memory/5588-2899-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2909-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2870-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2892-0x0000000077290000-0x000000007733F000-memory.dmp
memory/5588-2893-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2894-0x0000000076850000-0x0000000076933000-memory.dmp
memory/5588-2895-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2896-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2902-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2914-0x0000000075C10000-0x0000000075CE3000-memory.dmp
memory/5588-2897-0x0000000075C10000-0x0000000075CE3000-memory.dmp
memory/5588-2900-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2901-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2854-0x0000000075360000-0x00000000753DA000-memory.dmp
memory/5588-2913-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2864-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2861-0x0000000077290000-0x000000007733F000-memory.dmp
memory/5588-2862-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2848-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2863-0x0000000076850000-0x0000000076933000-memory.dmp
memory/5588-2869-0x0000000076850000-0x0000000076933000-memory.dmp
memory/5588-2871-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2880-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2860-0x0000000075DD0000-0x0000000075DF5000-memory.dmp
memory/5588-2857-0x0000000075360000-0x00000000753DA000-memory.dmp
memory/5588-2858-0x0000000075DD0000-0x0000000075DF5000-memory.dmp
memory/5588-2849-0x0000000075360000-0x00000000753DA000-memory.dmp
memory/5588-2852-0x0000000075360000-0x00000000753DA000-memory.dmp
memory/5588-2911-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2842-0x000000000D5E0000-0x000000000D69B000-memory.dmp
memory/5588-2915-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2859-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2865-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2873-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2879-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2878-0x0000000077290000-0x000000007733F000-memory.dmp
memory/5588-2877-0x0000000074A20000-0x0000000074A94000-memory.dmp
memory/5588-2876-0x0000000074F60000-0x0000000075170000-memory.dmp
memory/5588-2875-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2908-0x0000000075E60000-0x0000000076413000-memory.dmp
memory/5588-2856-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2874-0x0000000077290000-0x000000007733F000-memory.dmp
memory/5588-2872-0x0000000075C10000-0x0000000075CE3000-memory.dmp
memory/5588-2850-0x0000000000C90000-0x000000000578D000-memory.dmp
memory/5588-2866-0x0000000075CF0000-0x0000000075DCC000-memory.dmp
memory/5588-2867-0x0000000077290000-0x000000007733F000-memory.dmp
memory/5588-2868-0x0000000075E60000-0x0000000076413000-memory.dmp