Resubmissions
25/07/2026, 21:49
260725-1ps9tatzew1025/07/2026, 21:34
260725-1e319stycx825/07/2026, 21:27
260725-1a1ekstxhs10Analysis
- user interaction
yes - max time kernel
872s - max time network
866s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
25/07/2026, 21:34
General
- Target https://github.com/isPique/Fuck-Windows-Security
- Sample260725-1e319stycx
Score
8/10
Malware Config
Signatures
- Disables Task Manager via registry modification
- Downloads MZ/PE file 20 IoCs
- Drops file in Drivers directory 9 IoCs
- ASPack v2.12-2.42 4 IoCs
Detects executables packed with ASPack v2.12-2.42
- Executes dropped EXE 48 IoCs
- Loads dropped DLL 8 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- UPX packed file 16 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Program Files directory 1 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 9 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 13 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Kills process with taskkill 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 15 IoCs
- Suspicious behavior: AddClipboardFormatListener 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 53 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 45 IoCs
- Suspicious use of SetWindowsHookEx 28 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/isPique/Fuck-Windows-Security1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,23244472927586630,11267130500326672639,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,5104558859787534814,12804120834972228138,262144 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,6192734318327793572,15792040194468027058,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,15212361636134752785,2978670794547186437,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,8001944200225560646,5304018252729819539,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,11771806959040760744,3997635964538280011,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8349657562695909591,5663838666212857360,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,17043136202422280543,15842765239077620157,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,6732418402107508361,2882250839292953023,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,12437605746098359040,12526811008378705267,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,12437605746098359040,12526811008378705267,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,10173969572908715804,7108831981820858840,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6788,i,4979343959234099448,4571158734120500284,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4424,i,2614329146775576940,8366571692973247182,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4408,i,8097945840914991891,5524756841975665910,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7052,i,6081877491414565560,8800568828122631093,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,708944659922620132,9382633463571603357,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3868,i,8418734522987976116,17249427928371605992,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,1131735899781580223,4784464234932110738,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5100,i,5945494135290623818,6541010475256171275,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4428,i,16635472708367725079,17463747008697878884,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7276,i,10346157267366446481,1178933892195409767,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7376,i,11774597980876197301,15280352893578495084,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7516,i,9630410779846975756,4903471343785994979,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7132 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,9891698977653553323,5390367431003549172,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7988,i,17903669697100249486,4058641389968114514,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3908,i,17874517174723359102,14990734427242756924,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7596,i,1872536827202427096,10681415228665577557,262144 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7600 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,5462190668374074002,554479378932491385,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7540 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8036,i,6567592758138223290,1873868492658487476,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,3450994949515644172,13556292486511474041,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8020,i,7114268867437460103,11806214522578534260,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7324,i,2343705888144612145,16885229278106406389,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8048,i,13251298350918391398,15444016535880981681,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7596,i,6681396621130058538,14275272527068069114,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=7428,i,18043553810184857641,6155071201670659912,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=7560,i,13236014163810134399,4064803373110651484,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8272,i,6821694963702987686,12064591495112502602,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8268,i,3807117062532962996,11782876848755653994,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8236 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8240,i,9176917351354033028,1742559636414666019,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:82⤵
-
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\Melissa.doc" /o ""2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9000,i,10581710413753824832,4639974157314851230,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8740,i,14289925929656847419,6164788335218491483,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=8912,i,11512758624775324129,10996584859016852728,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,5867798970622166191,7831150152575845395,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8592,i,7777340412218721313,3602212057816506045,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8996 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --always-read-main-dll --metrics-shmem-handle=3900,i,7760718649648674892,11890244371266193681,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,3779167231536614179,9325913474423302105,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7460,i,16417031989271561023,15165684720087701151,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9004 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\WinNuke.98.exe"C:\Users\Admin\Downloads\WinNuke.98.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=8432,i,15740677482560071835,494027328152004870,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8504,i,6832186068830185832,2259543521124403659,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8912,i,8137711035764958480,1319483530221565893,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9200 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4580 -s 4323⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4208 -s 4003⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5580 -s 3083⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3140 -s 4003⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5604 -s 4003⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 4083⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5564 -s 4003⤵
- Program crash
-
-
-
C:\Users\Admin\Downloads\Floxif.exe"C:\Users\Admin\Downloads\Floxif.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6056 -s 3083⤵
- Program crash
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --always-read-main-dll --metrics-shmem-handle=8488,i,12520911235874756072,351555872883405549,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7532 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8696,i,15560271601448317630,11662975375595469337,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9192,i,16424805964605734691,8632655517026845834,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8784 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\Downloads\Gnil.exe"C:\Users\Admin\Downloads\Gnil.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\drivers\spoclsv.exeC:\Windows\system32\drivers\spoclsv.exe3⤵
- Executes dropped EXE
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=8748,i,8732955515484092498,10717446691217045102,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8924,i,7263055948532397273,7551872892476870213,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Mabezat.exe"C:\Users\Admin\Downloads\Mabezat.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --always-read-main-dll --metrics-shmem-handle=7240,i,16551660625791972026,4938424008009843137,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=8708,i,13544479587568407810,2269745432631504407,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8172 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --always-read-main-dll --metrics-shmem-handle=7440,i,12056990764117917230,14064675240185009467,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8548 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --always-read-main-dll --metrics-shmem-handle=7188,i,2855308433914653898,15690926824873460516,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7400 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --always-read-main-dll --metrics-shmem-handle=8412,i,12594207353820289903,8889878741119237209,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8820,i,9899721048989506620,9895010515655725092,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,6667181355767328364,15009949122970200292,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9188 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\DesktopBoom.exe"C:\Users\Admin\Downloads\DesktopBoom.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --always-read-main-dll --metrics-shmem-handle=8476,i,6103654586407981115,13049693653680984588,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9208 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7716,i,13797236773052738004,3862367416490965900,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8004 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9180,i,6271989327296050015,14144447225827470666,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Trololo.exe"C:\Users\Admin\Downloads\Trololo.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Downloads\Trololo.exe"C:\Users\Admin\Downloads\Trololo.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\Downloads\Trololo.exe"C:\Users\Admin\Downloads\Trololo.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im explorer.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\taskkill.exetaskkill.exe /f /im taskmgr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,9529523280117161779,3630960061163649522,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8436 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --always-read-main-dll --metrics-shmem-handle=7428,i,1998828616730187139,5627358235115459928,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8756 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,15747985419454677388,4696878347184657718,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7536 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Hydra.exe"C:\Users\Admin\Downloads\Hydra.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --always-read-main-dll --metrics-shmem-handle=3900,i,12016411209048853424,2000242127976661205,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9148 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8680,i,4812981616216319116,1928708378422310012,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7264,i,11905892506307176148,17579032407181494950,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Popup.exe"C:\Users\Admin\Downloads\Popup.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --always-read-main-dll --metrics-shmem-handle=7604,i,10275669482070379485,15400736094364423430,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3844,i,17834414892733567443,5662556232085436350,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8424 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8508,i,16352020342305784708,6267126734807990260,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Vista.exe"C:\Users\Admin\Downloads\Vista.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --always-read-main-dll --metrics-shmem-handle=7400,i,6403572155680351286,9439001855337825479,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7680 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8552,i,9339092791676297552,8139762958165826277,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,6386898100744871013,6324220192394785626,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9160 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\rickroll.exe"C:\Users\Admin\Downloads\rickroll.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --always-read-main-dll --metrics-shmem-handle=6956,i,10769560301575421715,12664845453163620358,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8220,i,5100742339201245581,16188350081051668288,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8536 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7412,i,13225214869666038458,15882204998010696318,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\WindowsUpdate.exe"C:\Users\Admin\Downloads\WindowsUpdate.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --always-read-main-dll --metrics-shmem-handle=8492,i,6287548067263487008,4570786282792433042,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8380 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8848,i,6069095084084690813,11891956435860642037,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\WindowsUpdate (1).exe"C:\Users\Admin\Downloads\WindowsUpdate (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --always-read-main-dll --metrics-shmem-handle=8600,i,8795510222834508825,1144629432259328533,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7640,i,8285337180158425579,11207891513704261957,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8812,i,11456563893219170351,14275128235265094652,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=1304 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\ScreenScrew.exe"C:\Users\Admin\Downloads\ScreenScrew.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --always-read-main-dll --metrics-shmem-handle=7604,i,14820315260079619993,16523177074882226789,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,5969774935686019677,1074107033639478119,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8376,i,6030030530899237362,7025064693660757521,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Flasher.exe"C:\Users\Admin\Downloads\Flasher.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --always-read-main-dll --metrics-shmem-handle=5088,i,16153286951509742679,17798448877694060092,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8460,i,4753458647221585862,2698508231796365327,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8584 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,16681920825792536063,11733144688937250447,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Curfun.exe"C:\Users\Admin\Downloads\Curfun.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=96 --always-read-main-dll --metrics-shmem-handle=5460,i,10269466886225731512,14921664013392663080,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8004,i,18371055911717172902,7735587685332105751,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,1943618084404080621,10968119591652402486,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8036 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\YouAreAnIdiot.exe"C:\Users\Admin\Downloads\YouAreAnIdiot.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 12003⤵
- Program crash
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --always-read-main-dll --metrics-shmem-handle=5088,i,10963590967889986562,16512762691786680614,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8600 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,15824952135708964759,14984117960338111330,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9192 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1364,i,7058560879119672054,6846853485974710157,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Avoid.exe"C:\Users\Admin\Downloads\Avoid.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --always-read-main-dll --metrics-shmem-handle=8488,i,15915675484359059135,12589023034390476626,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8792 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,15805742342147440507,3928780006743196113,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7536,i,12421213643490018360,11012696184587642294,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\ChilledWindows.exe"C:\Users\Admin\Downloads\ChilledWindows.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\ChilledWindows.exe"C:\Users\Admin\Downloads\ChilledWindows.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\ChilledWindows.exe"C:\Users\Admin\Downloads\ChilledWindows.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Downloads\ChilledWindows.exe"C:\Users\Admin\Downloads\ChilledWindows.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8460,i,14249674361402187338,12345791624763937772,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9172 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --always-read-main-dll --metrics-shmem-handle=7644,i,6765558632352551927,11943877375428992925,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,9976024735949119937,8081149300909338319,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,11653183604446360522,15203479844012310163,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\CookieClickerHack.exe"C:\Users\Admin\Downloads\CookieClickerHack.exe"2⤵
- Executes dropped EXE
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --always-read-main-dll --metrics-shmem-handle=8224,i,8761123121094888682,13308561477080863209,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,2939185034526639982,7030217614501734689,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8516,i,7127160177463584421,4930188330082342738,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=8388 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8552,i,7033247806048232355,8556646634792027707,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8552,i,7033247806048232355,8556646634792027707,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --always-read-main-dll --metrics-shmem-handle=5828,i,565670869042910555,4355569990057803335,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --always-read-main-dll --metrics-shmem-handle=7572,i,5766539254384174216,4119573102108152242,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9144,i,2070195551418884196,12476020093339773070,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,9445706326945955493,9678295312028661807,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Popup (1).exe"C:\Users\Admin\Downloads\Popup (1).exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7724,i,7488016611794295186,18297922459756729558,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7724,i,7488016611794295186,18297922459756729558,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --always-read-main-dll --metrics-shmem-handle=8820,i,1549629793977998804,4363133315778337536,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=9168 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --always-read-main-dll --metrics-shmem-handle=8988,i,5908279925140348032,739073755848655419,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --always-read-main-dll --metrics-shmem-handle=7360,i,10795172942101576582,16443530103373083335,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --always-read-main-dll --metrics-shmem-handle=9188,i,9104625165467489847,16761837560593672215,2097152 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8916,i,11785636742665144006,4707434005850512389,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9212,i,6912134647923988929,7060064990841079416,524288 --field-trial-handle=2220,i,12786966111356247575,11311359679812773679,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe"C:\Users\Admin\Downloads\Windows-KB2670838.msu.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE"C:\Program Files\Microsoft Office\Root\Office16\OUTLOOK.EXE" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4580 -ip 45801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4208 -ip 42081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 5580 -ip 55801⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 376 -p 3140 -ip 31401⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 5604 -ip 56041⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4248 -ip 42481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 5564 -ip 55641⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6056 -ip 60561⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4c0 0x4f41⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2384 -ip 23841⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
settings.dat
settings.dat
LOG.old
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_000078
f_000079
f_00007a
f_00007b
f_00007c
f_00007d
f_00007e
f_00007f
f_000080
f_000081
f_000082
f_000083
f_000084
f_000085
f_000086
f_000087
f_000088
f_000089
f_00008a
f_00008b
f_00008c
f_00008e
f_00008f
f_000091
f_000092
f_000093
f_000094
f_000095
f_000096
f_000098
f_000099
f_0000a0
f_0000a1
f_0000a2
f_0000a7
f_0000a8
f_0000aa
f_0000ac
f_0000af
f_0000b0
f_0000b1
f_0000b2
f_0000b4
f_0000b5
f_0000b8
f_0000ce
f_000126
f_000129
f_000132
0145dd6d05d5ec34_0
02cba9d43f494e35_0
037d50f6282266b6_0
043e05bc5f41aa2d_0
0b0a215eac67555b_0
0ca6285de0014b32_0
0ce2713e8adf411a_0
0da620fc6dc7ee14_0
118568d3ba26a588_0
147f283818bd64c1_0
1626b7c72856b119_0
18b514ad2fb822d5_0
1a0b89f7fd34af25_0
1ac68427de3efaf4_0
1d1c395a89ba8a1c_0
1df286cddca18b43_0
203211049b283da9_0
230b5e2b2d7fc126_0
233954b77c8a9f03_0
2719f6aef05e40bc_0
292667c5b5c8f0bf_0
2abfa54167c9c6a5_0
2c0876c0a60733fe_0
2f301630c02886db_0
2f4680e8f8f8a14f_0
310554555c9ad6d9_0
344acf8e378bad37_0
3617cfaf2a44d106_0
39a5e623cac641bd_0
3c0c42312719355f_0
3ddf367b1c677fa1_0
4044b751e9a43374_0
41e5ea4cda3e96d0_0
42fe3215c7d33b9f_0
435c5acafe2cce76_0
441aa94f48f631f3_0
44b2c19009f21eb1_0
45c6aba662e2e22f_0
46a74755a827666e_0
47f78fb6f1b604b1_0
48d4821f4cdd6e57_0
4bb2abd3e7b99cb0_0
4bc3c7392604fab3_0
4cfd5560dcde32ed_0
4d1557c9bfa8c13d_0
4ddbca3ed2813fd2_0
4e0a1e35c4b76d67_0
530f7a05d5c5a10a_0
53fc1be5cd2cf524_0
545322d3145b19dd_0
54a91f6ca50d874e_0
554de733985e5cf1_0
55a3a8b2400ba50b_0
5b0319d19122bf7b_0
5bd0e6c3657cb8bd_0
5c98b90eb48b00bf_0
5dc3512c5b269390_0
603edfaf554e4e96_0
6048c53dd280a81c_0
60f6c9d112fcc339_0
61a0b4d20ae0e222_0
61b62a97d3efdf63_0
65b0b0fc767d84dc_0
669ad7dac083a470_0
66b03f19c1344f65_0
6701c719f44a8355_0
677e92ebfa5e5d85_0
67a1609636514a62_0
69070c45655fd250_0
69a1a83b4b23a183_0
6b632f1e918054a9_0
6d36ad99b90ad0a8_0
6f87232646b115f2_0
702b75cbce0b0e1e_0
71b28b56b12b29ef_0
74038530c1d87459_0
76a4902a84029686_0
78b99223269c8493_0
79b8291d8ccaec46_0
7a6268d420b60dbf_0
7f3fbdeefd4c9113_0
7f445e9e48f59018_0
81e7c8e6050622e3_0
8315a57227dc9c74_0
87ea7150bd9dcf14_0
8888ac60d2881c10_0
8baa13f7b32fb253_0
8e4a6fae5396672d_0
8f2387009841ce42_0
902dab9d9c820d31_0
919fd2005ce53525_0
92aa708729096273_0
9713cb33d3dc71fe_0
97d60c88910180f9_0
9820ef3cdc166065_0
9ce20acdbc09e0aa_0
a236575518e56b0f_0
a2509c30c6083168_0
a4d78697d978ffb1_0
a628671d2f459a96_0
a6b4bdeb08834f3b_0
a7cba67100539a68_0
a81c9019d13b15ec_0
aa0df62cf6abd7bf_0
ab24cb64ffe820ba_0
ab977eb833b9d6d6_0
ac76bd8c035d787b_0
afd8af731ca95798_0
b1776dc063950125_0
b2597ccbfeda07b7_0
b26c75b0a854ea8b_0
b37fbf7135fa84dd_0
b4b94e8e2b36302e_0
b6fbd77626cfe3ec_0
b826ef3e3b1126d1_0
b92288c60239b694_0
bb742b026c70f76a_0
bcc62d73d6152581_0
bccb9d63d3bca86d_0
bd45e670ea07df95_0
be723dd753f18c51_0
c09a0df1ca419b57_0
c40a0ead5f45c71b_0
c6949150f564edb2_0
c6aa8e61aaa87dc0_0
c90260f5bf8f2119_0
c97ac2c920baa477_0
c985eeb4b7819207_0
c9a2119ff852daba_0
cb86d0d4e51cc8b7_0
cca2f54c57d5f605_0
cf13a7c27df43339_0
cf2cfa9b0dff6de1_0
cf68ae6bbbb296ca_0
cf81bc809fdf82a6_0
d19692fd573893db_0
d32bea5757de06bb_0
d4ccf8b73a2930ae_0
d64a1c84c5ccf951_0
d711f7b2256197bb_0
d79e0a2891fc014a_0
d7a1652b911c8b54_0
da2bd8a0950a5c31_0
df492132bb5a1ece_0
e1bf31a11aa397e5_0
e229cacda0d2ef86_0
e272ef151a351c19_0
e3c51fe67ae8ab8b_0
e5fc28cc5203145d_0
e6f0f24278c8e6bb_0
e93bf8a6b9ea2225_0
e9c7e700cc3e33cf_0
eb71961e8ddac0ae_0
ec897615f0886bd2_0
ef1e5fdc7d598e9c_0
f06208f304015f44_0
f1c8db786e57da2a_0
f618c047e021648b_0
f6415f2debed58e8_0
faa1f16e200023bb_0
fb85b047c292be8b_0
fc15564f196d27a8_0
fc306d34724073bc_0
fe3b6b914082df21_0
feec1fa739270b32_0
ff5868dc299ccec4_0
ff644be617274957_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a94df.TMP
SiteList-Enterprise.json
Edge Profile.ico
000003.log
CURRENT
LOG
000003.log
LOG.old
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries~RFe58f49c.TMP
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe597de1.TMP
4f2277ea2139c475_0
the-real-index
the-real-index
the-real-index
623cd082b6202da0_0
the-real-index
the-real-index
the-real-index
index.txt
index.txt
index.txt
ba23d8ecda68de77_0
the-real-index
the-real-index~RFe593752.TMP
sync_diagnostic.log
OperationConfig
OperationConfig~RFe594462.TMP
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe58f19e.TMP
0aaa7914-6507-4ad5-ae46-3fcac09f20d2.tmp
CurrentDatabase_400.wmdb
3207631C-9146-491F-9D11-04FFF81E8E86
mip_sdk.miplog
mip_sdk.miplog
outlook.exe.db-wal
089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres
49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
WMSDKNS.XML.bak
index.dat
default.dic
~WRD0000.tmp
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
ccba5a5986c77e43.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
fb3b0dbfee58fac8.customDestinations-ms
ChilledWindows.exe.crdownload
CookieClickerHack.exe
Curfun.exe
DesktopBoom.exe
Flasher.exe
Floxif.exe
Gnil.exe
Mabezat.exe
MadMan.exe
Melissa.doc
Popup.exe
ScreenScrew.exe
Trololo.exe
Vista.exe
WinNuke.98.exe
Windows-KB2670838.msu.exe
WindowsUpdate.exe
YouAreAnIdiot.exe
rickroll.exe
memory/220-4402-0x0000000000400000-0x0000000000444000-memory.dmp
memory/772-4407-0x0000000000400000-0x0000000000444000-memory.dmp
memory/1032-6114-0x0000000000010000-0x00000000000CC000-memory.dmp
memory/1096-4419-0x0000000000400000-0x0000000000444000-memory.dmp
memory/1276-5271-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/1276-5237-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/1276-5862-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/1276-6196-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/1448-5861-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/1448-6192-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/1448-5319-0x0000000000400000-0x00000000006BC000-memory.dmp
memory/2092-4395-0x0000000000400000-0x0000000000444000-memory.dmp
memory/2308-5591-0x0000000000750000-0x0000000000BB4000-memory.dmp
memory/2384-5487-0x0000000005A70000-0x0000000005AC6000-memory.dmp
memory/2384-5485-0x0000000005820000-0x00000000058BC000-memory.dmp
memory/2384-5484-0x0000000000F10000-0x0000000000F82000-memory.dmp
memory/2448-4374-0x0000000000400000-0x0000000000444000-memory.dmp
memory/2888-5238-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2972-4454-0x0000000001000000-0x0000000001026000-memory.dmp
memory/2988-4406-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3124-3937-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-4170-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-4172-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-4169-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-4171-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-3933-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-3935-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-3934-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-3936-0x00007FFB419F0000-0x00007FFB41A00000-memory.dmp
memory/3124-3939-0x00007FFB3F090000-0x00007FFB3F0A0000-memory.dmp
memory/3124-3938-0x00007FFB3F090000-0x00007FFB3F0A0000-memory.dmp
memory/3140-4323-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3140-4316-0x0000000010000000-0x0000000010030000-memory.dmp
memory/3220-5611-0x0000000022800000-0x000000002280E000-memory.dmp
memory/3220-5610-0x0000000022830000-0x0000000022868000-memory.dmp
memory/3364-4398-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3384-4418-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3464-5022-0x000000001B9E0000-0x000000001B9E8000-memory.dmp
memory/3464-5023-0x000000001C650000-0x000000001C69C000-memory.dmp
memory/3464-5020-0x000000001BEC0000-0x000000001C38E000-memory.dmp
memory/3560-5708-0x0000000000400000-0x00000000004A6000-memory.dmp
memory/3648-4415-0x0000000000400000-0x0000000000444000-memory.dmp
memory/3728-5067-0x0000000000120000-0x0000000000130000-memory.dmp
memory/3728-5070-0x0000000004CB0000-0x0000000004CBA000-memory.dmp
memory/3728-5069-0x0000000004B10000-0x0000000004BA2000-memory.dmp
memory/3728-5068-0x0000000004FE0000-0x0000000005584000-memory.dmp
memory/3936-5425-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/3936-5566-0x0000000000400000-0x00000000004A4000-memory.dmp
memory/4208-4314-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4208-4312-0x0000000000F00000-0x0000000000F75000-memory.dmp
memory/4208-4311-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4248-4324-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4248-4330-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4268-4394-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4356-5019-0x000000001B620000-0x000000001B6C6000-memory.dmp
memory/4356-5021-0x000000001C1C0000-0x000000001C25C000-memory.dmp
memory/4468-5703-0x0000000000400000-0x0000000000464000-memory.dmp
memory/4580-4294-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4580-4290-0x0000000010000000-0x0000000010030000-memory.dmp
memory/4580-4292-0x0000000000F00000-0x0000000000F75000-memory.dmp
memory/4668-4403-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4768-4371-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4768-4375-0x0000000000400000-0x0000000000444000-memory.dmp
memory/4932-4411-0x0000000000400000-0x0000000000444000-memory.dmp
memory/5328-4414-0x0000000000400000-0x0000000000444000-memory.dmp
memory/5360-5178-0x0000000000400000-0x0000000000ABC000-memory.dmp
memory/5508-6034-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/5564-4331-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5564-4335-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5580-4315-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5580-4319-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5604-4327-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5604-4320-0x0000000010000000-0x0000000010030000-memory.dmp
memory/5648-5157-0x0000000000400000-0x00000000004DF000-memory.dmp
memory/5648-4410-0x0000000000400000-0x0000000000444000-memory.dmp
memory/5776-5608-0x000000001C0E0000-0x000000001C0E8000-memory.dmp
memory/5796-5351-0x0000000000400000-0x000000000044A000-memory.dmp
memory/5796-5934-0x0000000000400000-0x000000000044A000-memory.dmp
memory/5864-4399-0x0000000000400000-0x0000000000444000-memory.dmp
memory/6056-4332-0x0000000010000000-0x0000000010030000-memory.dmp
memory/6056-4338-0x0000000010000000-0x0000000010030000-memory.dmp