Resubmissions
20/07/2026, 20:13
260720-yzn2qsfx2x1020/07/2026, 19:57
260720-ypf85sft8v1020/07/2026, 19:49
260720-yjtx2sdw6m820/07/2026, 19:43
260720-yfk6qse16x9Analysis
- geolocation tags
- user interaction
yes - max time kernel
639s - max time network
902s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 20:13
General
- Target $PLUGINSDIR/NSISdl.dll
- Size 15KB
- Sample260720-yzn2qsfx2x
- SHA256 ddf40229dd9d6b268902d8dea88c8a04aacf1af218dd29f6dcd35babc54ac08d
Score
10/10
Malware Config
Signatures
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Downloads MZ/PE file 3 IoCs
- Drops file in Drivers directory 9 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Sets service image path in registry 3 TTPs 4 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks BIOS information in registry 2 TTPs 10 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 39 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 16 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 64 IoCs
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 34 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 19 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Kills process with taskkill 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 5 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 15 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 12 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 6 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS1⤵
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\NSISdl.dll,#13⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 5444⤵
- Program crash
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x304,0x7ffc6853c188,0x7ffc6853c194,0x7ffc6853c1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,15522008040561673479,16136637365387938432,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:113⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1932,i,150136259283945245,3380991199333117413,262144 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,12476189896329654831,1722205421077965872,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,14304664038103130229,15384576928464245005,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3552,i,10959932576460312716,2841813247290019303,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,6636211054209122707,12695775852369201644,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,6352050248684967677,17468565858596489081,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:93⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,2986766044492055557,2903669253685821735,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,3729111959284287329,12230478742176843774,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,3896764652142028536,8671603702328001737,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=3916 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6211405941299266966,12052527944078958147,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,6211405941299266966,12052527944078958147,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,4647211958655876815,5448915788138219677,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,12174190334266614428,12401719443640648363,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,882779240525774749,1348534242076311549,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7164,i,2768266298181438273,17157000761648908211,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7112,i,6986581994621846370,5141474905355240732,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7176,i,13020188120597447848,8479621702102111564,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7340,i,15139900023932088982,9655729812883961498,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,10610183625699096782,16858003720168632178,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7492 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7632,i,444015857224611974,9878052677330900956,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,7820760266468146995,15281544273989393527,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7720 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7584,i,1688515769138330264,13385849971119794731,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1260,i,5140351193180678352,10667500008181502082,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1272,i,14336487019486291008,537138771370536952,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1280,i,14039762439745635763,13860885819861988354,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\Coffin32.exe"C:\Users\Admin\Downloads\Coffin32.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exe"C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\8AC3.tmp\8AC4.tmp\8AC5.vbs //Nologo4⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8AC3.tmp\MainWindow.exe"C:\Users\Admin\AppData\Local\Temp\8AC3.tmp\MainWindow.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\8AC3.tmp\PatBlt.exe"C:\Users\Admin\AppData\Local\Temp\8AC3.tmp\PatBlt.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\8AC3.tmp\musicplayer.vbs"5⤵
- Enumerates connected drives
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of AdjustPrivilegeToken
- System policy modification
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im MainWindow.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im PatBlt.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im wscript.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,5458804570615089281,5027508414549891310,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,11516927496225861906,6124533882864235043,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,9895402762717585137,4037773641488084457,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1488,i,12565993246990906695,1293821309788029978,262144 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:103⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,660966041529768060,17367957282888077210,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=948,i,12326966609911521592,3522224458405699858,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6092 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,233989536516400853,16656986437344217965,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=1464 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,10521720712467183661,14645365024727540488,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,15657348370220611938,3369143077505482556,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7880,i,17343251484303793617,3066340271310536194,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=5744,i,9403592789782555156,14689777369673362409,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5636,i,7163288031142487595,6703250802007915248,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=3860 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=7056,i,16531468007572022646,4640078798699205798,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8004,i,11305393714987119334,593684797103159934,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8080 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7220,i,821693359248456918,5455571062141230727,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8384 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8388,i,8295977564864349026,14467324191266770856,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8484 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"3⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8448,i,5554352237187682562,472791151633798742,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8500 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,4981588845099123069,3747662223691317895,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8212,i,5060794073463740417,11752029802749701237,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8344 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,8135150278063097344,7874453527607485240,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,12720597587688045290,5075214912984869246,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=5696,i,14338414132351124179,10477482150865595232,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8452 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=6440,i,9762095835643539421,5767116000274040727,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8440,i,8510580640098132247,12144248781180969406,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --always-read-main-dll --metrics-shmem-handle=3532,i,134331116588852827,10257683287625219119,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7992 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8812,i,12329087467900062255,2787250417748066067,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --always-read-main-dll --metrics-shmem-handle=8512,i,14070846237582928424,1808982393452165498,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8940,i,530987407635935643,13879010033168981439,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9036,i,5160550894661810085,4420163345614790509,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=9064 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=5560,i,6600330921554538820,16476621086322690668,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6715255611882931532,6070851585019272475,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7820,i,6468827064632953641,16607589941503529635,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=7844 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7792,i,292082544974548284,12817712630529501832,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8208,i,8878351919253295090,11918888207266550948,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8232 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\StartBlueScreen.exe"C:\Users\Admin\Downloads\StartBlueScreen.exe"3⤵
-
-
C:\Users\Admin\Downloads\StartBlueScreen.exe"C:\Users\Admin\Downloads\StartBlueScreen.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --always-read-main-dll --metrics-shmem-handle=9012,i,13105465892577472999,471007479541859519,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --always-read-main-dll --metrics-shmem-handle=5688,i,2933963400412840135,2033100142737833274,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,15373619839023429792,14507361255449660078,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=9024 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,8341041189521520607,2492288901113726413,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=9084 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8876,i,10567866107862015447,16598632235690009790,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8928 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=8980,i,14039040353556481533,15704768069667006938,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=9036 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --always-read-main-dll --metrics-shmem-handle=9048,i,8757358486587249049,8253874815462593010,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=9016 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,2415117934697321448,3626008866003269428,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8876 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,7036659115430086254,11641549434871720886,524288 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8984 /prefetch:143⤵
-
-
C:\Users\Admin\Downloads\BonziBuddy_original.exe"C:\Users\Admin\Downloads\BonziBuddy_original.exe"3⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --always-read-main-dll --metrics-shmem-handle=8152,i,13578506779422427096,15891870364838821976,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8564 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --always-read-main-dll --metrics-shmem-handle=8720,i,1490505789627029689,845158645044168769,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=1372 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=7876,i,1917939333603661954,15834243282256467929,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --always-read-main-dll --metrics-shmem-handle=8016,i,3141382001216666188,11382520386777879432,2097152 --field-trial-handle=2556,i,13171512786367735019,10201190568934543468,262144 --variations-seed-version --mojo-platform-channel-handle=9040 /prefetch:13⤵
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /72⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
-
C:\Users\Admin\Downloads\MB-SupportTool.exe"C:\Users\Admin\Downloads\MB-SupportTool.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\7zSF541.tmp\mbstub.exe.\mbstub.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\AppData\Local\Temp\mwb7DF.tmp\mb-support.exeC:\Users\Admin\AppData\Local\Temp\mwb7DF.tmp\mb-support.exe6⤵
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies system certificate store
-
-
-
-
-
-
C:\Users\Admin\Downloads\clippy.exe"C:\Users\Admin\Downloads\clippy.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\clippy.exe"C:\Users\Admin\Downloads\clippy.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3100 -ip 31001⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "00000000000001A0" "Service-0x0-3e7$\Default" "00000000000001A4" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies system certificate store
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ig.exeig.exe reseed2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMWsc.exe" /wac 0 /status on true /updatesubstatus none /scansubstatus none /settingssubstatus none2⤵
- Executes dropped EXE
-
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe"C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe" "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json" "C:\ProgramData\Malwarebytes\MBAMService" "C:\ProgramData\Malwarebytes\MBAMService\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\X86_00\ig.exeig.exe timer 4000 17845791170.ext2⤵
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\X86_00\ig.exeig.exe timer 4000 17845791260.ext2⤵
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\X86_03\ig.exeig.exe timer 4000 17845791513.ext2⤵
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\X86_01\ig.exeig.exe timer 4000 17845791861.ext2⤵
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\X86_01\ig.exeig.exe timer 4000 17845791941.ext2⤵
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\srchadmin.dll ,1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\DRIVERS\mwac.sysC:\Windows\system32\DRIVERS\mwac.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\DRIVERS\mbam.sysC:\Windows\system32\DRIVERS\mbam.sys1⤵
- Executes dropped EXE
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004BC 0x00000000000004B81⤵
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
4Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
mbtun.cat
mbtun.sys
MBAMInstallerService.exe
MBVpnTunnelService.exe
MBVpnTunnel_mbtun.dll
mbamsi64.dll
mbtun.dll
mbtun.inf
offreg.dll
farflt11.cat
farflt11.inf
farflt11.sys
mbamchameleon.cat
mbamchameleon.inf
mbamchameleon.sys
7z.dll
MBAMService.exe
MBAMWsc.exe
Malwarebytes_Assistant.runtimeconfig.json
mbae.sys
mbamelam.cat
mbamelam.inf
mbamelam.sys
srvversion.dat
MBAMCoreV5.dll
.version
mbae-default.log
ffc290b2-8478-11f1-a570-faf4715c9799.json
AeConfig.json
AeConfig.json
AeConfig.json
ArwControllerConfig.json
ArwControllerConfig.json
CleanControllerConfig.json
CloudConfig.json
CloudConfig.json
CloudConfig.json
LicenseConfig.json
LicenseConfig.json
MwacControllerConfig.json
MwacControllerConfig.json
PoliciesConfig.json
PoliciesConfig.json
RtpConfig.json
RtpConfig.json
ScanConfig.json
ScanConfig.json
ScanConfig.json
SpConfigFile.json
SpConfigFile.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
UI_IrisSettings.json
UI_IrisSettings.json
UI_IrisSettings.json
UI_WhatsNewSettings.json
UpdateControllerConfig.json
VPNControllerConfig.json
VPNServerListConfig.json
MBSetup.exe
mbrescue.exe
4bf8da72847911f1a7d9faf4715c9799
SdkDbUpdatrV5.dll
expapply64.dll
mbupdatrV5.exe
version.dat
6bed52c8-b740-4da3-89ea-e423abdaa957.tmp
settings.dat
settings.dat
LOG.old
LOG.old
f_000079
f_00007b
f_000089
f_00008c
f_00008d
f_00008f
f_000091
f_000093
f_000098
f_00009b
f_0000a2
f_0000a3
f_0000a4
f_0000a5
f_0000a6
f_0000a7
f_0000a9
f_0000aa
f_0000ac
f_0000ad
f_0000ae
f_0000af
f_0000b0
f_0000b1
f_0000b2
f_0000b3
f_0000b4
f_0000b5
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_0000bb
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c1
f_0000c2
f_0000c8
f_0000de
temp-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5cb6e4.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
CURRENT
LOG
MANIFEST-000001
000003.log
LOG.old
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
0771a272e58d90ca_0
0771a272e58d90ca_1
18031f09388d52ce_0
18031f09388d52ce_1
278122a2eb096440_0
278122a2eb096440_1
3742e809c03a504e_0
3742e809c03a504e_1
3af56eff56e414a6_0
3af56eff56e414a6_1
3e65315ca2c21eaa_0
3e65315ca2c21eaa_1
43c5553ba2e53f3c_0
43c5553ba2e53f3c_1
50ffab1faa8729c9_0
50ffab1faa8729c9_1
53f0a9e501fcc806_0
53f0a9e501fcc806_1
5524d7e552fd889a_0
5524d7e552fd889a_1
5b1e7dce94504d49_0
5b1e7dce94504d49_1
611f1e35ee082a63_0
611f1e35ee082a63_1
62344765313d86e6_0
62344765313d86e6_1
85f73dd0b35f337f_0
85f73dd0b35f337f_1
90276fa133edf2ce_0
90276fa133edf2ce_1
bd3f9ee3f2e520bc_0
bd3f9ee3f2e520bc_1
c65e36407de7ae26_0
c65e36407de7ae26_1
dbde16ab26738e46_0
dbde16ab26738e46_1
e4071f6047faef52_0
e4071f6047faef52_1
the-real-index
the-real-index
the-real-index~RFe5c15f1.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5fc4d0.TMP
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
index.txt
index.txt
ba23d8ecda68de77_0
ba23d8ecda68de77_1
the-real-index
the-real-index~RFe5c69cd.TMP
OperationConfig
OperationConfig~RFe5cfd63.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5c7007.TMP
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
397a7d63-0188-4b84-9d75-b8313fc19c5c.tmp
CurrentDatabase_400.wmdb
8AC5.vbs
Cofdance.mp3
MainWindow.exe
PatBlt.exe
musicplayer.vbs
MASH0001.TMP
mbsetup.log
FRSTEnglish.exe
content_new.js
BonzVir.msh
BonziBuddy_original.exe
Coffin32.exe.crdownload
MB-SupportTool.exe
MBSetup-2.2.exe.crdownload
StartBlueScreen.exe
clippy.exe
mbtun.inf_amd64_add82795013a7c3b.ini
dberr.txt
1F657678CDAD5400251B323D207EA54F
D84E548583BE1EE7DB5A935821009D26_5B98B6CD6E69202676965CF5B0E2A7A7
F9C57C8B55E84B295CBBD8CF3D95BF44
1F657678CDAD5400251B323D207EA54F
F9C57C8B55E84B295CBBD8CF3D95BF44
LICENSE
mb_2BC7.tmp
memory/1892-6443-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-7212-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-6870-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-6009-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-6803-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-7392-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-7365-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-6501-0x0000000000400000-0x0000000000547000-memory.dmp
memory/1892-7215-0x0000000000400000-0x0000000000547000-memory.dmp
memory/3024-5189-0x0000000002DA0000-0x0000000002DAE000-memory.dmp
memory/3024-5206-0x0000000006590000-0x0000000006642000-memory.dmp
memory/3024-5188-0x0000000000960000-0x0000000000AD0000-memory.dmp
memory/3024-5226-0x00000000077B0000-0x00000000077BE000-memory.dmp
memory/3024-5190-0x0000000005540000-0x000000000556A000-memory.dmp
memory/3024-5225-0x00000000077E0000-0x000000000781E000-memory.dmp
memory/3024-5224-0x0000000007790000-0x0000000007798000-memory.dmp
memory/3024-5223-0x0000000007C80000-0x0000000007D94000-memory.dmp
memory/3024-5211-0x00000000073D0000-0x0000000007462000-memory.dmp
memory/3024-5209-0x0000000006C10000-0x00000000071CA000-memory.dmp
memory/3024-5227-0x0000000007DA0000-0x0000000008DA0000-memory.dmp
memory/3024-5208-0x0000000005960000-0x000000000596C000-memory.dmp
memory/3024-5203-0x00000000058E0000-0x0000000005926000-memory.dmp
memory/3024-5298-0x0000000013CD0000-0x000000001402B000-memory.dmp
memory/3024-5228-0x0000000007830000-0x0000000007840000-memory.dmp
memory/3024-5207-0x0000000005950000-0x0000000005958000-memory.dmp
memory/3024-5297-0x0000000010D40000-0x0000000010D62000-memory.dmp
memory/3904-6397-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3904-6381-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4744-1180-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1191-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1182-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1186-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1188-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1187-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1189-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4744-1190-0x000001B74CFB0000-0x000001B74CFB1000-memory.dmp
memory/4976-1114-0x0000000000400000-0x000000000041D000-memory.dmp
memory/5944-7413-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-7393-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-6877-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-6948-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-6603-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-6130-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-6503-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-7227-0x0000000000400000-0x0000000000547000-memory.dmp
memory/5944-7216-0x0000000000400000-0x0000000000547000-memory.dmp
memory/6112-1113-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/6112-1067-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/6212-4918-0x0000016493B60000-0x0000016493DFE000-memory.dmp
memory/6260-5056-0x000002919DEC0000-0x000002919E15E000-memory.dmp
memory/6612-7256-0x0000000000400000-0x000000000046F000-memory.dmp
memory/6612-7258-0x0000000000400000-0x000000000046F000-memory.dmp
memory/6612-7257-0x0000000000400000-0x000000000046F000-memory.dmp
memory/6612-7273-0x0000000000400000-0x000000000046F000-memory.dmp