Analysis
- user interaction
yes - max time kernel
1049s - max time network
1049s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
20/06/2026, 11:41
General
- Target welcom.vbs
- Size 1KB
- Sample260620-ntsgvsfy5x
- SHA256 1aa9b4920db250ee3726156af5ff2f75ac98bd3544c908d172d2405ef1ba9a0a
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Drops desktop.ini file(s) 3 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 14 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 3 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 54 IoCs
- Opens file in notepad (likely ransom note) 2 IoCs
- Suspicious behavior: AddClipboardFormatListener 6 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cv_debug.log1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\cv_debug.log1⤵
- Opens file in notepad (likely ransom note)
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConfirmGroup.mhtml1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x220,0x2f0,0x2f4,0x21c,0x2fc,0x7ffe3473c188,0x7ffe3473c194,0x7ffe3473c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,3726657356466542803,11816021027593610716,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,10077943464896149518,16472215247161409104,262144 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,10618915793009967666,4694755066257785773,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3592,i,18208811360009034056,218564148150545161,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3600,i,1954279148637457346,16017900215331535518,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,2126177883868959181,18023381439000795779,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,9274149195070636170,14693033967171747696,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=1884,i,4446634569777692744,16665987926830176983,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4312,i,17218465094865420867,1367808428156929417,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5108,i,12182995508805371527,826709785838404152,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5712,i,6502439219722559578,2227624624705020340,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5716,i,1619306108402643920,9389075767942362383,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5668,i,9917009393446429406,14283340055532035145,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5748,i,9767603125687353394,8754905089773270819,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,8245959951984908864,7429071840652538263,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,13529295990900461873,5523521965978152743,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4032 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,12567728455757084179,5232932291671394948,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,15917775274792316197,14862354598556464220,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,15917775274792316197,14862354598556464220,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1492,i,16073442397324606421,8898011586730563430,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1496,i,13979434965147585903,1765531168214210221,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1448,i,2655047190151023916,11167038906068275835,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4036,i,14061109839067683892,13920961841261375923,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,4571327439664035863,10179660567005981220,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,14616767547024670993,11996754249179537746,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4564,i,422319730384278628,4225925416623917606,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7124,i,2368301753652965786,8693775222057165258,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7564,i,10323580056293883207,13806553855848944897,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7392,i,1474697176945233325,10242196970796855922,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7620,i,15690090252877337635,12715238461504165557,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=4620,i,12150662179590192478,17673542907072258861,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4864,i,8206388159972603627,114333262093504852,262144 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3164,i,13725424652422884003,10928035439028311203,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,1288391685729847101,14914936087731941358,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7780,i,17928187850485213931,15232783299504306347,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8060,i,2360471889882600434,1328391973497735685,2097152 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7928,i,12322903374278576609,5328904967623482432,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3208,i,14599372877870284555,15140027216904268090,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=3960 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,14646363683376557181,35716360218863629,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4656 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,1980516301057135928,3335602864670654901,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=7296 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,10357838819633162458,16026495822886198752,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7880,i,9644090117973669901,3618358381807752096,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1432,i,12860658988350684439,15878487205482487244,524288 --field-trial-handle=2612,i,4988249054717186814,3889648339681579478,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConfirmGroup.mhtml1⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConfirmGroup.mhtml1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Desktop\ConfirmGroup.mhtml1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\welcom.vbs"1⤵
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\....[===== ].vbs"1⤵
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k mode con: cols=80 lines=25 & color 0F2⤵
-
C:\Windows\system32\mode.commode con: cols=80 lines=253⤵
-
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\70acf4aa6a564a56b4f60799977dbe73 /t 3464 /p 34601⤵
-
C:\Windows\system32\userinit.exeC:\Windows\system32\userinit.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE2⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"3⤵
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x0000000000000500 0x000000000000050C1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\oobe\UserOOBEBroker.exeC:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
settings.dat
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_00005d
f_00005e
f_000060
f_000062
f_000065
f_000098
f_000099
f_00009a
f_00009b
the-real-index
the-real-index
the-real-index
the-real-index
SiteList-Enterprise.json
Edge Profile.ico
0f873e95-871b-4f3a-a39b-5b542c066f15.tmp
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5c0547.TMP
index.txt
index.txt
index.txt
the-real-index
the-real-index~RFe5c578e.TMP
sync_diagnostic.log
sync_diagnostic.log
OperationConfig
OperationConfig~RFe5bf6ff.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
metadata.json
metadata.json
metadata.json
metadata.json
c1f02b64-fc0a-4a01-aeb0-cf3af9fb68bf.tmp
prep_Activatable Class_Hermes_perf.cache
microsoftwindows.client[1].xml
cv_debug.log
content_new.js
default.exc
memory/1972-110-0x00007FFE57E50000-0x00007FFE57E9E000-memory.dmp
memory/1972-107-0x00007FFE55190000-0x00007FFE551D0000-memory.dmp
memory/1972-111-0x00007FFE57E30000-0x00007FFE57E44000-memory.dmp
memory/1972-105-0x00007FFE55260000-0x00007FFE55380000-memory.dmp
memory/1972-106-0x00007FFE55200000-0x00007FFE55255000-memory.dmp
memory/4880-159-0x0000027207040000-0x0000027207140000-memory.dmp
memory/4880-160-0x0000027207040000-0x0000027207140000-memory.dmp
memory/4880-165-0x000002720A720000-0x000002720A740000-memory.dmp
memory/4880-166-0x000002720AB40000-0x000002720AC40000-memory.dmp
memory/4880-3615-0x000002721FEF0000-0x000002721FFF0000-memory.dmp
memory/4880-161-0x0000027207040000-0x0000027207140000-memory.dmp
memory/4880-180-0x000002720A980000-0x000002720A9A0000-memory.dmp
memory/4880-205-0x000002721AF00000-0x000002721AF20000-memory.dmp
memory/4880-1314-0x000002721BEE0000-0x000002721BFE0000-memory.dmp