Resubmissions
05/08/2026, 17:49
260805-wecf4axzgw05/08/2026, 17:41
260805-v9hqxsdj3w1005/08/2026, 17:33
260805-v42a3ssbph10Analysis
- user interaction
yes - max time kernel
306s - max time network
336s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
05/08/2026, 17:33
Errors
Reason
Machine shutdown
General
- Target http://git hub
- Sample260805-v42a3ssbph
Score
10/10
Malware Config
Signatures
- Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
- Detects KillMBR 1 IoCs
- Downloads MZ/PE file 4 IoCs
- ASPack v2.12-2.42 1 IoCs
Detects executables packed with ASPack v2.12-2.42
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 27 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Drops file in Windows directory 2 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 30 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Control Panel 42 IoCs
- Modifies data under HKEY_USERS 2 IoCs
- Modifies registry class 11 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 22 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://git hub1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb7b9dc188,0x7ffb7b9dc194,0x7ffb7b9dc1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,13323941000648287887,6037891601974135018,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:32⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,7593115735802923819,11868259750359581053,262144 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,12496605991069851110,16610790821608244116,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,11971770109195581008,16164106599809174220,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,414838914860475144,15519063363158884482,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,8391089315051936111,13812780288729491761,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,393981093029600069,591618880146655216,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,8575299388959699735,775019352813451366,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5228,i,7527769165955418257,17399562438426094973,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,11556149303311533381,1856558111131524936,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,9281235240205699345,691128075063650099,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2937240162123378541,11380406471915598396,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,2937240162123378541,11380406471915598396,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3700,i,2249759043877296615,15062401965020404055,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5344,i,10631289145043962680,5220246720341690851,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5284,i,11973602424103085081,2643743773028670853,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4708,i,270488883290092118,11912661144854678787,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4732,i,3704114703729376751,4684545159840260918,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,18294759553538737964,15094723774394365173,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,17557146669067149589,10037793758631939568,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,11197426360288199552,11358562137465241843,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6596,i,1198361827618938916,5780462524950707175,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6712,i,481179657112542479,1929616843225336146,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,6898818624111645596,12246295196233823916,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6768,i,15109140201383424246,17092476838968535197,262144 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,10506501625724738224,3190700266728708182,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7104,i,17418392526379892692,5869161021635533750,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7284,i,9225886959595212043,15001575613965576587,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7496,i,11735037828831486661,14018274598062216496,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,8223250450558951142,13028048611164222738,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6928,i,1926870849980795282,13819776170078346692,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,5313086489992915672,10422142313415626314,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7368 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,17150519953126293166,6892983159803017430,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2712,i,13817040605175347354,1529956785052094278,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=1544 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,5850389668711694661,9132787481534937129,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,11462926814041879637,9545523656973017188,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Control Panel
-
-
C:\Users\Admin\Downloads\ColorBug.exe"C:\Users\Admin\Downloads\ColorBug.exe"2⤵
- Executes dropped EXE
- Modifies Control Panel
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7064,i,11655390538287965019,5170196182560904909,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7416 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7300,i,2293639022246311012,6354836917382811267,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7336,i,12539376118067655934,11527943351486955722,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\BlueScreen.exe"C:\Users\Admin\Downloads\BlueScreen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\BlueScreen.exe"C:\Users\Admin\Downloads\BlueScreen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\BlueScreen.exe"C:\Users\Admin\Downloads\BlueScreen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\BlueScreen.exe"C:\Users\Admin\Downloads\BlueScreen.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=6952,i,16677833410252487108,386735672510745117,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,11107135603710060534,10331420028137797911,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7700,i,3478564611451715904,1733012334995915639,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /main3⤵
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
-
-
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /watchdog3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\MEMZ.exe"C:\Users\Admin\Downloads\MEMZ.exe" /main3⤵
- Checks computer location settings
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\System32\notepad.exe" \note.txt4⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"4⤵
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=7668,i,18191338663091239279,15363270101356404773,2097152 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,18048795566529697286,6266489099741982586,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7440 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Zika.exe"C:\Users\Admin\Downloads\Zika.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -extract C:\bonzi\blue.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, icongroup,,3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -addoverwrite C:\bonzi\blue.exe", "C:\bonzi\blue.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res, icongroup,,3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -extract C:\bonzi\clippy.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, icongroup,,3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -addoverwrite C:\bonzi\clippy.exe", "C:\bonzi\clippy.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -extract C:\bonzi\StartBlueScreen.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -addoverwrite C:\bonzi\StartBlueScreen.exe", "C:\bonzi\StartBlueScreen.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -extract C:\bonzi\netscape\updater.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.rc, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe"C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\svchost.exe" -addoverwrite C:\bonzi\netscape\updater.exe", "C:\bonzi\netscape\updater.exe, C:\Users\Admin\AppData\Local\Temp\9c72f5b8b2594a46a7fcbf9972d9c8ad\icons.res, icongroup,,3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,3881563156186067595,4382126865279777354,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:82⤵
-
-
C:\Users\Admin\Downloads\Zika.exe"C:\Users\Admin\Downloads\Zika.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -extract C:\bonzi\bob.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, icongroup,,3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -extract C:\bonzi\BonziBuddy_original.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, icongroup,,3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -addoverwrite C:\bonzi\BonziBuddy_original.exe", "C:\bonzi\BonziBuddy_original.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -extract C:\bonzi\LimePro.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -addoverwrite C:\bonzi\LimePro.exe", "C:\bonzi\LimePro.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -extract C:\bonzi\optimize.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -addoverwrite C:\bonzi\optimize.exe", "C:\bonzi\optimize.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -extract C:\bonzi\netscape\navigator.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -addoverwrite C:\bonzi\netscape\navigator.exe", "C:\bonzi\netscape\navigator.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\svchost.exe" -extract C:\bonzi\netscape\xpicleanup.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, icongroup,,3⤵
-
-
C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe"C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.rc, C:\Users\Admin\AppData\Local\Temp\33be7040486349be8c82ff38db7f9162\icons.res3⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,12842658200987963052,10909367034164698301,524288 --field-trial-handle=2288,i,7515612307273135889,14627861032308073958,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Temp1_BonziKill.zip\BonziKill.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_BonziKill.zip\BonziKill.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\bonzi\BonziBuddy_original.exe"C:\bonzi\BonziBuddy_original.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\BonziKill\BonziKill.exe"C:\Users\Admin\Downloads\BonziKill\BonziKill.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\bonzi\BonziBuddy_original.exe"C:\bonzi\BonziBuddy_original.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Downloads\BonziKill\BonziKill.exe"C:\Users\Admin\Downloads\BonziKill\BonziKill.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\bonzi\BonziBuddy_original.exe"C:\bonzi\BonziBuddy_original.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
MANIFEST-000001
BookmarkMergedSurfaceOrdering
f_0000b1
f_0000b3
f_0000c6
3fa631bf8ffa2ad9_0
the-real-index
the-real-index
the-real-index
the-real-index~RFe5943d5.TMP
SiteList-Enterprise.json
Edge Profile.ico
CURRENT
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries~RFe5919b8.TMP
Preferences
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index~RFe591beb.TMP
the-real-index
the-real-index~RFe594b96.TMP
index.txt
the-real-index
the-real-index~RFe591d13.TMP
sync_diagnostic.log
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe59c27b.TMP
6d01b6ff-a5f4-41b9-8430-7ef27c62b351.tmp
5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
taskhost.ini
MASH0001.TMP
ccba5a5986c77e43.customDestinations-ms
ColorBug.exe
MEMZ.exe
Zika.exe
agentanm.dll
agentctl.dll
agentdp2.dll
agentdpv.dll
agentmpx.dll
agentpsh.dll
agentsr.dll
agentsvr.exe
agtctl15.tlb
agtintl.dll
Bonzi.acs
Genie.acs
agt0405.dll
agt0406.dll
agt0407.dll
agt0408.dll
agt0409.dll
agt040b.dll
agt040c.dll
agt040e.dll
agt0410.dll
agt0412.dll
agt0413.dll
agt0414.dll
agt0415.dll
agt0416.dll
agt0419.dll
agt041d.dll
agt041f.dll
agt0816.dll
agt0c0a.dll
mslwvtts.dll
BonzVir.msh
LimePro.exe
bg.bat
blue.exe
bob.exe
boi.bat
china.wav
clippy.exe
dicks.wav
end.bat
midi.bat
AccessibleMarshal.dll
browserconfig.properties
browser.jar
browser.manifest
classic.jar
classic.manifest
comm.jar
comm.manifest
en-US.jar
en-US.manifest
pippki.jar
pippki.manifest
reporter.jar
reporter.manifest
toolkit.jar
toolkit.manifest
browser.xpt
BonziBuddy_original.exe
StartBlueScreen.exe
LICENSE
README.txt
FeedConverter.js
FeedProcessor.js
FeedWriter.js
WebContentConverter.js
cache-module.js
compreg.dat
jar50.dll
jsconsole-clhandler.js
jsd3250.dll
linkpad-module.js
myspell.dll
nsBookmarkTransactionManager.js
nsBrowserContentHandler.js
nsBrowserGlue.js
nsCloseAllWindows.js
nsDefaultCLH.js
nsDictionary.js
nsExtensionManager.js
nsHelperAppDlg.js
nsMicrosummaryService.js
nsPostUpdateWin.js
nsProxyAutoConfig.js
nsSafebrowsingApplication.js
nsSearchService.js
nsSearchSuggestions.js
nsSessionStartup.js
nsSessionStore.js
nsSetDefaultBrowser.js
nsSidebar.js
nsURLFormatter.js
nsUpdateService.js
nsUrlClassifierLib.js
nsUrlClassifierListManager.js
nsUrlClassifierTable.js
nsXmlRpcClient.js
spellchk.dll
splash.js
xpinstal.dll
xpti.dat
platform.js
prefcalls.js
channel-prefs.js
firefox-branding.js
firefox-l10n.js
firefox.js
bookmarks.html
userChrome-example.css
userContent-example.css
localstore.rdf
mimeTypes.rdf
prefs.js
search.rdf
en-US.aff
en-US.dic
chrome.manifest
winInspectorMain.ico
inspector.jar
inspector-cmdline.js
inspector.js
install.rdf
chrome.manifest
ns9migrator-en-US.jar
ns9migrator.jar
install.rdf
install.rdf
freebl3.chk
freebl3.dll
all.js
security-prefs.js
xpinstall.js
js3250.dll
msvcp71.dll
msvcr71.dll
navigator.exe
nspr4.dll
nss3.dll
nssckbi.dll
old-homepage-default.properties
plc4.dll
plds4.dll
npnul32.dll
EditorOverride.css
arrow.gif
arrowd.gif
broken-image.gif
charsetData.properties
charsetalias.properties
cmessage.txt
mathml.dtd
xhtml11.dtd
html40Latin1.properties
html40Special.properties
html40Symbols.properties
htmlEntityVersions.properties
mathml20.properties
transliterate.properties
fontEncoding.properties
fontNameMap.properties
mathfont.properties
mathfontCMEX10.properties
mathfontCMSY10.properties
mathfontMTExtra.properties
mathfontMath1.properties
mathfontMath2.properties
mathfontMath4.properties
mathfontPUA.properties
mathfontSymbol.properties
forms.css
grabber.gif
hiddenWindow.html
html.css
gopher-audio.gif
gopher-binary.gif
gopher-find.gif
gopher-image.gif
gopher-menu.gif
gopher-movie.gif
gopher-telnet.gif
gopher-text.gif
gopher-unknown.gif
langGroups.properties
language.properties
loading-image.gif
mathml.css
quirk.css
svg.css
table-add-column-after-active.gif
table-add-column-after-hover.gif
table-add-column-after.gif
table-add-column-before-active.gif
table-add-column-before-hover.gif
table-add-column-before.gif
table-add-row-after-active.gif
table-add-row-after-hover.gif
table-add-row-after.gif
table-add-row-before-active.gif
table-add-row-before-hover.gif
table-add-row-before.gif
table-remove-column-active.gif
table-remove-column-hover.gif
table-remove-column.gif
ua.css
viewsource.css
wincharset.properties
amazondotcom.xml
aol.xml
ask.xml
eBay.xml
google.xml
netscape.xml
yahoo.xml
smime3.dll
softokn3.chk
softokn3.dll
ssl3.dll
updater.exe
updater.ini
xpcom.dll
xpcom_compat.dll
xpcom_core.dll
xpicleanup.exe
xpistub.dll
nice.bat
nice.mp3
optimize.exe
org.wav
paint.mp3
pepsi.wav
score.wav
smash.mp3
start.bat
vape.wav
wave.jpg
memory/604-3714-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/1068-3618-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/1308-3571-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/1748-3738-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/1800-3597-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/1820-3504-0x0000000005C10000-0x0000000005CA2000-memory.dmp
memory/1888-3707-0x0000000000400000-0x000000000084A000-memory.dmp
memory/2192-2802-0x0000000000400000-0x000000000046F000-memory.dmp
memory/2328-3580-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/2500-3537-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/2504-3640-0x0000000000400000-0x000000000084A000-memory.dmp
memory/2696-3637-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/3196-3559-0x0000000000400000-0x000000000084A000-memory.dmp
memory/3236-3729-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/3320-3680-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/3416-3320-0x0000000000400000-0x0000000000414000-memory.dmp
memory/3544-3671-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/3584-3560-0x0000000000400000-0x000000000084A000-memory.dmp
memory/4492-3700-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/4832-3654-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/4848-3588-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5192-3531-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5660-3494-0x0000000000A20000-0x0000000000FCC000-memory.dmp
memory/5660-3503-0x0000000006050000-0x00000000065F4000-memory.dmp
memory/5676-3612-0x0000000000400000-0x000000000084A000-memory.dmp
memory/5756-2222-0x0000000000400000-0x000000000046F000-memory.dmp
memory/5756-2225-0x0000000000400000-0x000000000046F000-memory.dmp
memory/5756-2224-0x0000000000400000-0x000000000046F000-memory.dmp
memory/5756-2252-0x0000000000400000-0x000000000046F000-memory.dmp
memory/5768-3385-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5768-3359-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5768-3363-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5820-3720-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5860-3362-0x0000000000400000-0x0000000000409000-memory.dmp
memory/5900-3609-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5932-3732-0x0000000000400000-0x000000000084A000-memory.dmp
memory/5960-3691-0x0000000000400000-0x00000000004DD000-memory.dmp
memory/5964-3591-0x0000000000400000-0x000000000084A000-memory.dmp
memory/5964-3743-0x0000000000400000-0x000000000084A000-memory.dmp
memory/5976-3659-0x0000000000400000-0x000000000084A000-memory.dmp
memory/5992-3694-0x0000000000400000-0x000000000084A000-memory.dmp
memory/6064-3294-0x0000000000400000-0x000000000046F000-memory.dmp
memory/6064-3305-0x0000000000400000-0x000000000046F000-memory.dmp
memory/6092-3321-0x0000000000400000-0x0000000000414000-memory.dmp