Resubmissions
02/08/2026, 17:30
260802-v25kqadl7y1002/08/2026, 17:19
260802-vv41lsdb891002/08/2026, 17:11
260802-vqa7qstthx10Analysis
- user interaction
yes - max time kernel
421s - max time network
442s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
02/08/2026, 17:11
Errors
Reason
Machine shutdown
General
- Target http://google.com
- Sample260802-vqa7qstthx
Score
10/10
Malware Config
Signatures
- Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
- Detects KillMBR 1 IoCs
- Downloads MZ/PE file 7 IoCs
- Executes dropped EXE 22 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 3 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 9 IoCs
- Modifies Control Panel 64 IoCs
- Modifies data under HKEY_USERS 4 IoCs
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 32 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdf46ec188,0x7ffdf46ec194,0x7ffdf46ec1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,3112914570425174238,10477460448107854287,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:112⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,13848747720391550245,11312300838060268341,262144 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,11691344221279477158,8923102843105188993,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,2503323112306625678,6329716536712766267,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,16389053600456508787,16178011618323771191,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,18079023233686275719,7902930732293724261,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,6058173442172374794,16142634623177399811,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3748,i,16150957660306189202,4402486810327574890,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,2724041398616825677,12258252061518948428,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,10000443996449548715,6840533603576657165,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7337982525824852778,10661741835261313691,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,7337982525824852778,10661741835261313691,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4972,i,6164898482568168159,1800685801721151323,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5192,i,5012712283272800685,14780844271236164773,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6608,i,8553013336485104913,2932175122519970303,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,14654192137555336236,9948610676650502988,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,10823629566818935790,5120743421699897248,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6916,i,6954433897052540434,12313731449968337097,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6980 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5216,i,17139116541036163155,6249473860669937155,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3728,i,16271062437915801243,4147601323130177008,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6576,i,851485069553146274,11698428768024620421,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,886435931780010558,491857188965698364,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6944,i,7111710678786832265,16593610651251063519,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,1727427355761191972,15838672506162927958,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7420,i,9859473704270608081,15883170300740248060,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,7539557947894341473,18401313513835941849,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6276,i,8728522845753401027,8784569778800965147,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7892,i,6598390732696350021,10500452833180171305,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=7908 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=8020,i,13339839937754132828,6301800980007485075,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8412,i,1454152227472199772,15269891276225610903,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8204,i,1984158146331921501,13458583772743898657,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8552 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8572,i,16830080518087766883,13061383450248877475,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8704 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8896,i,6208015278100414679,14241900909118577304,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8900 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8140,i,7797797966914075134,6339438405183700633,262144 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8128 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7070730452831447575,7656644589821022575,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7070730452831447575,7656644589821022575,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=8152,i,15917276559665729348,9092455751062750674,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:12⤵
-
-
C:\Users\Admin\Downloads\ClassicShell.exe"C:\Users\Admin\Downloads\ClassicShell.exe"2⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,1024062727846665222,6686470105368689445,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8664,i,12151849820896842585,18280425343014930638,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8624,i,9475965577667284539,13453421340941214483,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8324 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=8148,i,11824072572103056209,6516664285010624181,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8912 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=8028,i,1190236353934909758,8082928785536077352,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8572 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=8380,i,4303766380499037218,15963694258231901370,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,1937104705520707932,3292234565640418143,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8636 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=9160,i,6689535198959825953,16431479306937552656,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=9184 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=8740,i,17149544556535160420,3230023965265799923,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8604,i,7604945391742151039,15516303382582100788,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,16766514021503825857,16023671402109648607,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6840,i,11746621231135823567,10265507823979728437,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,12093367065038894645,13818833980739359570,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,7776774896353982170,13862993320639241863,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8924 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\WinNuke.98.exe"C:\Users\Admin\Downloads\WinNuke.98.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --always-read-main-dll --metrics-shmem-handle=5452,i,1490392308192443418,8062679519014786905,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8024 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8668,i,12706057260201269692,10344851098652344524,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8932,i,3313906730328229288,4599832116980540103,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8948 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\BlueScreen.exe"C:\Users\Admin\Downloads\BlueScreen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,903002345495972039,8307070867887058262,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8696 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8952,i,12589284419235073880,7144704509738620225,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --always-read-main-dll --metrics-shmem-handle=5764,i,16402996365785258482,3135667540722243285,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,4534405840419517669,10021645141285589637,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=9072 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,3100817082469596983,10842914354006322716,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --always-read-main-dll --metrics-shmem-handle=9212,i,12915488342455554992,786077978476355319,2097152 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,3912582800109745009,17190892976110621463,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=8940 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8484,i,1097499081303237967,12281579308817362171,524288 --field-trial-handle=2508,i,10325162966394218077,11418595054153518442,262144 --variations-seed-version --mojo-platform-channel-handle=9068 /prefetch:142⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /main3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe4⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays4⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x240,0x270,0x7ffdf46ec188,0x7ffdf46ec194,0x7ffdf46ec1a03⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,2023634027204606555,4871183925134690207,262144 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:23⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8881496039648410421,16009795932016648217,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:113⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,7417206201701658047,15498057756458242359,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:133⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,6356912932862663821,5092546019393131609,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,6356912932862663821,5092546019393131609,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,6713596749863591494,5665585531487024813,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,1808119451971188814,17932012808381391004,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,14442359195044364397,367578775711475377,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4579757525776485706,7698626709627156939,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,15668969860533447681,2931341707078544817,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4900,i,6780674600460643244,12587944444048698816,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,677857879515414812,8887730097467671183,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5492,i,2182578811429075126,356183355092666911,2097152 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5448,i,3091103530565952921,3136859951876794260,2097152 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,5733427870765792251,6764143917191885525,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5740,i,6736476523311404337,6483610989572587125,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6156,i,13452237518467847760,8581801652002909946,2097152 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,10054412385904774199,233457494925261755,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,15328933157545945930,3887454070415499749,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,2273280620999350352,10078546751252581559,524288 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:143⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6460,i,9889870291226661643,15999692594846975492,2097152 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=2832,i,10971957843169952391,17845183598971611556,2097152 --field-trial-handle=2236,i,17280703877201664865,16433032079437444861,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window3⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffdf46ec188,0x7ffdf46ec194,0x7ffdf46ec1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,16242048511986132722,2553770771119177430,262144 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,8481542152021002666,15822055348249421993,524288 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2392,i,14938775222287818265,6076705250741486775,524288 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,18416113570054155875,6884526309733634295,524288 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,18416113570054155875,6884526309733634295,524288 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5112,i,3911549524462066776,10012070978634135415,2097152 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5132,i,8868198310276108197,4459352818374484892,2097152 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,2174518404180119269,8317589608694575544,524288 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,8859298753585814588,2712151791702820004,524288 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6064,i,13532376192636344955,5876634449710949407,2097152 --field-trial-handle=2328,i,6723458613131165177,7934075446293258783,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\Downloads\ClassicShell.exe"C:\Users\Admin\Downloads\ClassicShell.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Downloads\ClassicShell.exe"C:\Users\Admin\Downloads\ClassicShell.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Downloads\ClassicShell.exe"C:\Users\Admin\Downloads\ClassicShell.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Downloads\ClassicShell.exe"C:\Users\Admin\Downloads\ClassicShell.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Downloads\ClassicShell.exe"C:\Users\Admin\Downloads\ClassicShell.exe"1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\Downloads\Mabezat.exe"C:\Users\Admin\Downloads\Mabezat.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"1⤵
- Executes dropped EXE
- Modifies Control Panel
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"1⤵
- Executes dropped EXE
- Modifies Control Panel
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
8d424147-8cdf-4da8-ae88-2e9338d0c3d1.tmp
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
54436a29-0a9d-47d6-af98-a13db7c8a740.tmp
7597d607-1fc6-44eb-b687-d1f476c26c3d.tmp
LOG.old
f_0000a1
f_0000a2
f_0000a4
f_0000aa
f_0000ad
f_0000af
f_0000b3
f_0000b6
f_0000b7
f_0000b8
f_0000b9
f_0000ba
f_000102
f_000103
f_000104
f_000105
f_000106
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b0b76.TMP
data_1
SiteList-Enterprise.json
Edge Profile.ico
000003.log
LOG
MANIFEST-000001
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
the-real-index~RFe5a4e9e.TMP
index.txt
the-real-index
the-real-index~RFe5ae2d0.TMP
f60b918a98600aaa_0
the-real-index
the-real-index
sync_diagnostic.log
CURRENT
MANIFEST-000001
index.txt
index.txt
index.txt~RFe5a4d27.TMP
d087aefe-a918-4496-8330-06e88a5482bf.tmp
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59f013.TMP
0a9ad3bf-6600-4e92-bbd6-aa378ca24241.tmp
ca718b1f-1b7b-4886-913c-7a0588b1f780.tmp
content_new.js
ccba5a5986c77e43.customDestinations-ms
BlueScreen.exe
ClassicShell.exe.crdownload
ColorBug.exe
MEMZ.exe
Mabezat.exe
MadMan.exe
WinNuke.98.exe
memory/1116-2631-0x0000000000400000-0x0000000000414000-memory.dmp
memory/1868-1971-0x0000000000400000-0x0000000000AD8000-memory.dmp
memory/2784-2629-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3088-2371-0x0000000001000000-0x0000000001026000-memory.dmp
memory/4360-2551-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4360-2547-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4408-2333-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-3534-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2630-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2501-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2462-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2422-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2651-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2396-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2608-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2662-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2370-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2671-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2361-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2700-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2549-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2014-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-3510-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2732-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2002-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1991-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1988-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2518-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-2527-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1963-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1962-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1961-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1937-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-3210-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1936-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-1934-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-3234-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1938-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-1939-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-1935-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-3261-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4408-1930-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-1928-0x00000298B6B60000-0x00000298B6B61000-memory.dmp
memory/4408-2583-0x00000298B70A0000-0x00000298B7136000-memory.dmp
memory/4432-1997-0x0000000000400000-0x0000000000AD8000-memory.dmp
memory/5588-2634-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5636-2632-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5812-1990-0x0000000000400000-0x0000000000AD8000-memory.dmp
memory/6180-1999-0x0000000000400000-0x0000000000AD8000-memory.dmp
memory/6248-2001-0x0000000000400000-0x0000000000AD8000-memory.dmp
memory/6256-2652-0x0000000000400000-0x0000000000414000-memory.dmp
memory/6284-2653-0x0000000000400000-0x0000000000414000-memory.dmp
memory/6404-2013-0x0000000000400000-0x0000000000AD8000-memory.dmp