Analysis
- user interaction
yes - max time kernel
413s - max time network
559s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-fr - resource tags
- submitted
09/09/2026, 09:49
General
- Target Xeno-v1.3.60.exe
- Size 84.8MB
- Sample260909-ltjtlsvbmg
- SHA256 4d53875a7fc6f65842488484d95eae9df10a7ace1e4cebdd6f4959770500f5d0
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file 3 IoCs
- Drops file in Drivers directory 6 IoCs
- Modifies RDP port number used by Windows 1 TTPs
- Patched UPX-packed file 1 IoCs
Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.
- Sets service image path in registry 3 TTPs 2 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 8 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 38 IoCs
- Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
- Loads dropped DLL 64 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- ConfuserEx .NET packer 1 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 64 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 36 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 1 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Modifies trusted root certificate store through registry 1 TTPs 13 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
- System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 4 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 17 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 14 IoCs
- Kills process with taskkill 1 IoCs
- Modifies Control Panel 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 11 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 64 IoCs
- Modifies system certificate store 2 TTPs 12 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 42 IoCs
- Suspicious use of SendNotifyMessage 8 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\Xeno-v1.3.60.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exeC:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1656 --field-trial-handle=1668,i,4349334859280959535,17697333173365923987,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=2296 --field-trial-handle=1668,i,4349334859280959535,17697333173365923987,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --app-user-model-id=Xeno --app-path="C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\resources\app.asar" --enable-sandbox --first-renderer-process --lang=fr --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2516 --field-trial-handle=1668,i,4349334859280959535,17697333173365923987,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:13⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.gg/xe-no3⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2ec,0x2f0,0x2f4,0x2e8,0x314,0x7ff9a973c188,0x7ff9a973c194,0x7ff9a973c1a04⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,13633994696600795159,12138981944908344304,262144 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:24⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1668,i,2228919197763268697,17921187696447633657,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2732,i,14743744728878076565,10208261214592486419,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=2864 /prefetch:134⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3564,i,12115486276740796263,4958659870246829177,2097152 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3568,i,3788348073191714943,5817747094434761024,2097152 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4328,i,10401352979768441309,14463082846515942292,2097152 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,8479086281408923128,13960109502627044218,2097152 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:94⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,8813807303634611223,875960458234881861,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5496,i,11954970391544384132,4384993081696994461,2097152 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,15156543351628835368,8138844858222205097,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,56908396383667638,5876189866518446996,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,15713943157473293159,15322412430936154893,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,11719356168304834263,6171010626239613776,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,13267337320128482642,8841420046918423148,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:124⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,15713943157473293159,15322412430936154893,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,805367924675543093,11522155930987504849,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,9483375933677188543,2549562932833318948,524288 --field-trial-handle=2272,i,12541782775204166626,7479934733903133735,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:144⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window4⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x290,0x7ff9a973c188,0x7ff9a973c194,0x7ff9a973c1a05⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,8087611544276085513,8625690833446511500,262144 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:25⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,3782632797081483533,11928057694237690332,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:115⤵
- Downloads MZ/PE file
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,16339681360317758066,9119568907143776916,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:135⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,8265178247408516014,635373766334472099,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,8265178247408516014,635373766334472099,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=5144,i,14322233514325349805,4286775569666361303,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5140,i,661229068745059311,14725684515990331421,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7450936969215818839,3176499292421728306,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,11327315024921904327,7575876336121640021,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6764,i,12089075822989206929,9912230969383359795,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,16488623474938429621,11430522819273993801,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,8498928407364393843,4776199916090122123,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,13731884033632171004,8958485237798050769,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=7020,i,13317725602958078895,2945636940100515505,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6740,i,3498312225170508017,16973830012747402061,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6372,i,2178010162294529409,6661247563762276501,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6744,i,10556358591834873524,11362964765399455132,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7512,i,7304433132266164149,14032155035166871458,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7252,i,14419370989802398219,16670520972324247400,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7368,i,9407759459841197310,10319178781580251692,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:125⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7984,i,1878390392044432780,1901418245371611751,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7964 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8068,i,7971579964337013274,10632368282194812712,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8064 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=8172,i,11953980167771070902,5502197864802135967,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8200 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8364,i,15489372081888456668,2672344190481999558,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8320 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8100,i,11878400427649937917,12133379125000487271,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=7972 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,8780140611143733040,17208104106172833644,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3704,i,15630820914763537180,12548268379217643401,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8080,i,8979529878991286130,17749140776734597899,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8748 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8808,i,4483660864904163915,2206535312474734126,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8832 /prefetch:145⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6620,i,6807757559387959001,6840469923743554322,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8620 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8336,i,178506028937350776,11716220522677224435,2097152 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8700 /prefetch:15⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8504,i,6338589970097780503,276688556009246146,524288 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=8376 /prefetch:145⤵
-
-
C:\Users\Admin\Downloads\RobloxPlayerInstaller-VV8VHB6P9R.exe"C:\Users\Admin\Downloads\RobloxPlayerInstaller-VV8VHB6P9R.exe"5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -personalizedToken VV8VHB6P9R --deeplink https://www.roblox.com/games/5312327368/Super-Hero-Tycoon --webBtid 1788947694704003 --downloadSource installer --authenticationTicket U1TmP-Ca3CwAAsvKgU2xRsucy5CZTx9_ZdBGlxgn7bSIBKwKgiiqjDjRmzUI7UrfRG_frIPWvVCSd3n0TLk1pr0B2agSUdKzagunx2SChrZ0TIA4MU8CpG6X1cgbukBThuP1A0eSKvMuXbBzGScOpO0wsfbbJHxk18CJF214wupQkyLWRsABMNjZSDXioqc95_Anu2C1ro02yu5D_xypoKmWjEyjDflU09nhptiQHeNzZAel7ac3Fg7f_7igsHTFqFq9u_UBHSfyybJ2aImtE9bVq3FNkI39ovhmwTPTbQRblDEOVf363BV33ek56MFyM1wptGWXDlXnzWVyOcigXP6QhKVBsG8gaXwXPXw_DmnUfxDBiJ7ilLrFhQumFldrZJr5e6MI2nlBwxzZmu5o0olU5sazu9Uj-ZAkrVse6bsI4B9FqSeK2BW7Xa0RyDROeJ-oyiCIqgP4agz_vVAVBivdkb_6j0foQ3gTOEYA3sroBWyCDFyn3niDOp7Y-Lxap3BIf1QU5VmvnLawij9u19veC40zEtBMGYov4OVMJCjfeS3Mkehv9YiiFzf093BO -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 76526⤵
- Executes dropped EXE
-
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe" -personalizedToken VV8VHB6P9R --deeplink https://www.roblox.com/games/5312327368/Super-Hero-Tycoon --webBtid 1788947694704003 --downloadSource installer --authenticationTicket U1TmP-Ca3CwAAsvKgU2xRsucy5CZTx9_ZdBGlxgn7bSIBKwKgiiqjDjRmzUI7UrfRG_frIPWvVCSd3n0TLk1pr0B2agSUdKzagunx2SChrZ0TIA4MU8CpG6X1cgbukBThuP1A0eSKvMuXbBzGScOpO0wsfbbJHxk18CJF214wupQkyLWRsABMNjZSDXioqc95_Anu2C1ro02yu5D_xypoKmWjEyjDflU09nhptiQHeNzZAel7ac3Fg7f_7igsHTFqFq9u_UBHSfyybJ2aImtE9bVq3FNkI39ovhmwTPTbQRblDEOVf363BV33ek56MFyM1wptGWXDlXnzWVyOcigXP6QhKVBsG8gaXwXPXw_DmnUfxDBiJ7ilLrFhQumFldrZJr5e6MI2nlBwxzZmu5o0olU5sazu9Uj-ZAkrVse6bsI4B9FqSeK2BW7Xa0RyDROeJ-oyiCIqgP4agz_vVAVBivdkb_6j0foQ3gTOEYA3sroBWyCDFyn3niDOp7Y-Lxap3BIf1QU5VmvnLawij9u19veC40zEtBMGYov4OVMJCjfeS3Mkehv9YiiFzf093BO -app -installerLaunchTimeEpochMs 0 -clientLaunchTimeEpochMs 0 -isInstallerLaunch 76526⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7756,i,15435243549211867611,15497911953222602970,262144 --field-trial-handle=2340,i,240828317312421938,15095694459566520007,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:105⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window5⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff9a973c188,0x7ff9a973c194,0x7ff9a973c1a06⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,3271245494797504440,18040182357398263750,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:116⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,10201059891815075857,1858897910991443849,262144 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:26⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2160,i,12465342723579200376,18435983899445701412,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:136⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4488,i,16125316187899516181,9135211810193630167,2097152 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4680,i,4971840232017335612,7583552248405686328,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,12005593317591400173,9116972104332697992,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5256,i,11011109729999163581,9505691866407373285,2097152 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15685910477917693684,6487221864672371449,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,15685910477917693684,6487221864672371449,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,4458812985845830410,12135033591208712851,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,10697524567349428487,11641791678326510257,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,5068602277410269304,11337333179693924750,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,13336994556609044405,13178679957338639800,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,10457287107814056626,15890156773419670665,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,10381725581692154886,6365556806147644089,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,1861452641745281028,3760112322607695471,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,1106595733645034010,4886483745361492995,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6368,i,15519876652937793215,15322054602764403135,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6416,i,3242309625719938759,5634413343684895818,2097152 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:16⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,3670559471590745845,1165010808068883993,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=fr --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,14489762753200592838,3723050997853871271,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:146⤵
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"6⤵
- Downloads MZ/PE file
- Drops file in Drivers directory
- Checks BIOS information in registry
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /t 1 & "C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\timeout.exetimeout /t 18⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension "C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi"8⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -install -extension C:\Users\Admin\AppData\Local\Temp\{242af0bb-db11-4734-b7a0-61cb8a9b20fb}.xpi9⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1936 -prefsLen 27098 -prefMapHandle 1940 -prefMapSize 270279 -ipcHandle 2024 -initialChannelId {0bfa47a9-4547-4c79-b9d8-31727cddae13} -parentPid 7724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu10⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27134 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2428 -initialChannelId {96728e3c-6551-48c6-bad1-c0bd9f6a9bcd} -parentPid 7724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket10⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3732 -prefsLen 27323 -prefMapHandle 3736 -prefMapSize 270279 -jsInitHandle 3740 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3748 -initialChannelId {36c56c9f-0711-4e5b-981d-6248f1926841} -parentPid 7724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab10⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3932 -prefsLen 27323 -prefMapHandle 3936 -prefMapSize 270279 -ipcHandle 4004 -initialChannelId {3b2e720f-a27d-4fa9-87c8-2d8376246df3} -parentPid 7724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7724" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd10⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4368 -prefsLen 34822 -prefMapHandle 4372 -prefMapSize 270279 -jsInitHandle 4376 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 2972 -initialChannelId {50614895-e6fc-4116-a859-f9d7a15890d9} -parentPid 7724 -crashReporter "\\.\pipe\gecko-crash-server-pipe.7724" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab10⤵
- Checks processor information in registry
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,1198161491021078096,16483296609868114579,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:146⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,1198161491021078096,16483296609868114579,524288 --field-trial-handle=2692,i,3656253542637100850,6809847066435578675,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:146⤵
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\Downloads\MBSetup-2.2.exe"C:\Users\Admin\Downloads\MBSetup-2.2.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window6⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ff9a973c188,0x7ff9a973c194,0x7ff9a973c1a07⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9888241223384031459,8224983235574824888,262144 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:27⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,4959656694512865371,16216341514532536197,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:117⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,3172606562308173040,6524015656251085399,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:137⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,4137951892405600123,4993655454205781495,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4428,i,4137951892405600123,4993655454205781495,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4916,i,7419294410086655270,9168324003964966304,2097152 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,14395306678534155083,9260642043709532715,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,3411562771982112808,12858085760916445879,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5624,i,14485485800666237498,5007285324030354549,2097152 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:17⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,13172434837228175646,11509275379886531097,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,11030015413327115625,989133127936846085,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,13719476950941653095,10533126801748130428,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,12599623556859881063,891986119687807861,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,11726470227853387333,13618887346933292501,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,7115591911669364706,14165261476496063938,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,14346108509586924681,15422489709172461870,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,10714553994889007909,7868806097398043127,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,5476628383934226100,18354466584467699041,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,5770870974857518242,6564579938462812998,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,749318857559666275,3638149953844834654,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5280,i,7551964313836523493,11385796483744330157,262144 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:107⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,17891065413248023111,8170111774500199156,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,16815330809807472982,11548526314539558831,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=1088 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,7469352612152491734,536378503412101031,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:147⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,10090928158150432989,11762469117714260786,524288 --field-trial-handle=2332,i,11084699270578983515,10871155543702911703,262144 --variations-seed-version --mojo-platform-channel-handle=3380 /prefetch:147⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1696 --field-trial-handle=1668,i,4349334859280959535,17697333173365923987,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=fr --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --mojo-platform-channel-handle=3716 --field-trial-handle=1668,i,4349334859280959535,17697333173365923987,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:83⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe"C:\Users\Admin\AppData\Local\Temp\3HX07FOBiyOg71948xsiFB0hHSJ\Xeno-v1.3.60.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --user-data-dir="C:\Users\Admin\AppData\Roaming\Xeno" --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=3872 --field-trial-handle=1668,i,4349334859280959535,17697333173365923987,262144 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:23⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /F /IM RobloxPlayerBeta.exe /T"3⤵
- Executes a command shell one-liner
-
C:\Windows\system32\taskkill.exetaskkill /F /IM RobloxPlayerBeta.exe /T4⤵
- Kills process with taskkill
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"C:\Program Files\Roblox\Versions\version-e7d81637d42c4b23\RobloxPlayerBeta.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"1⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe" /installmbtun2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe" /Service /Protected2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Drops file in Windows directory
- Modifies registry class
-
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMInstallerService.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBVpnTunnelService.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Event Triggered Execution: Netsh Helper DLL
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "9" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun\mbtun.inf" "9" "4ba9030c7" "0000000000000198" "Service-0x0-3e7$\Default" "0000000000000174" "208" "C:\Program Files\Malwarebytes\Anti-Malware\mbtun"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\DRIVERS\MbamElam.sysC:\Windows\system32\DRIVERS\MbamElam.sys1⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"C:\Program Files\Malwarebytes\Anti-Malware\MBAMService.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe"C:\ProgramData\Malwarebytes\MBAMService\rmode\mbrescue.exe" /rescuemode "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService"2⤵
- Checks BIOS information in registry
- Executes dropped EXE
-
-
C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe"C:\ProgramData\Malwarebytes\MBAMService\updatrpkg\mbupdatrV5.exe" "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService\config\UpdateControllerConfig.json" "C:\ProgramData\Malwarebytes\MBAMService" "C:\ProgramData\Malwarebytes\MBAMService\dbclsupdate\staging" /db:dbupdate /su:no2⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
-
C:\Users\Admin\AppData\LocalLow\IGDump\sec\ig.exeig.exe secure2⤵
- Executes dropped EXE
-
-
C:\Program Files\Malwarebytes\Anti-Malware\ddshelper.exe"C:\Program Files\Malwarebytes\Anti-Malware\ddshelper.exe" "C:\Program Files\Malwarebytes\Anti-Malware" "C:\ProgramData\Malwarebytes\MBAMService" "Malwarebytes" "Global\MBUP_6318e286-ac35-11f1-a31c-76d091d9d973"2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k AppReadiness -p -s AppReadiness1⤵
-
C:\Windows\system32\DRIVERS\mbamswissarmy.sysC:\Windows\system32\DRIVERS\mbamswissarmy.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\DRIVERS\MbamChameleon.sysC:\Windows\system32\DRIVERS\MbamChameleon.sys1⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"1⤵
- Executes dropped EXE
-
C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"C:\Program Files\Malwarebytes\Anti-Malware\Malwarebytes.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
2Component Object Model Hijacking
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Safe Mode Boot
1Modify Registry
3Subvert Trust Controls
2Install Root Certificate
2Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
mbtun.inf
RobloxStudioInstaller.exe
7z.dll
MBAMService.exe
MBAMWsc.exe
Malwarebytes_Assistant.runtimeconfig.json
mbae.sys
mbamelam.cat
mbamelam.inf
mbamelam.sys
mbuns.exe
srvversion.dat
MBAMCoreV5.dll
.version
3e93e032-ac35-11f1-b301-76d091d9d973.json
AeConfig.json
AeConfig.json
ArwControllerConfig.json
CleanControllerConfig.json
CloudConfig.json
CloudConfig.json
LicenseConfig.json
LicenseConfig.json
LicenseConfig.json
MwacControllerConfig.json
PoliciesConfig.json
RtpConfig.json
RtpConfig.json
ScanConfig.json
ScanConfig.json
SpConfigFile.json
TelemCtrlConfig.json
TelemCtrlConfig.json
TelemCtrlConfig.json
UI_IrisSettings.json
UI_IrisSettings.json
UI_IrisSettings.json
UI_WhatsNewSettings.json
UpdateControllerConfig.json
UpdateControllerConfig.json
UpdateControllerConfig.json
VPNControllerConfig.json
VPNServerListConfig.json
MBSetup.exe
mbrescue.exe
SdkDbUpdatrV5.dll
expapply64.dll
mbupdatrV5.exe
version.dat
F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
settings.dat
0ddd43c8-cead-417c-a284-96552bfc7675.tmp
51de0a41-161b-4e67-9278-0409edbdf723.tmp
5ce5ed63-82ed-4468-bea1-d7aa5fd95c5f.tmp
MANIFEST-000001
LOG.old
f_0000b0
f_0000b6
f_0000bc
f_0000bd
f_0000be
f_0000bf
f_0000c0
f_0000c8
f_0000cb
f_0000cd
f_0000cf
f_0000f7
f_000217
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5a30c6.TMP
SiteList-Enterprise.json
Edge Profile.ico
History
000003.log
CURRENT
000005.ldb
MANIFEST-000001
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Sdch Dictionaries
Sdch Dictionaries
Sdch Dictionaries
TransportSecurity
TransportSecurity
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Preferences
Secure Preferences
Secure Preferences
Secure Preferences
Secure Preferences
index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b8cbc.TMP
the-real-index
the-real-index
the-real-index
the-real-index~RFe5e7cee.TMP
211d2fafe8c75831_0
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index
the-real-index~RFe5b8cbc.TMP
the-real-index~RFe5e85c8.TMP
the-real-index
the-real-index
the-real-index~RFe5a93e5.TMP
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt
index.txt~RFe59e92d.TMP
LOG
the-real-index
the-real-index~RFe5ae7a2.TMP
000003.log
LOG
sync_diagnostic.log
b4d6591f-56fa-4783-b6ff-226d8b4b6414.tmp
d0c75627-c4e6-4eb0-a39a-0a9ec7f76f7f.tmp
Last Version
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter
RevisitationBloomfilter~RFe5b44a7.TMP
data_1
Variations
c9735457-0c0f-47c6-ad76-831610eb6a60.tmp
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
metadata.json
bb28e322-bc77-4aa4-a9ff-ed85c5188bc7.tmp
mbsetup.log
LICENSE.electron.txt
LICENSES.chromium.html
chrome_100_percent.pak
chrome_200_percent.pak
d3dcompiler_47.dll
ffmpeg.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
af.pak
am.pak
ar.pak
bg.pak
bn.pak
ca.pak
cs.pak
da.pak
de.pak
el.pak
en-GB.pak
en-US.pak
es-419.pak
es.pak
et.pak
fa.pak
fi.pak
fil.pak
fr.pak
gu.pak
he.pak
hi.pak
hr.pak
hu.pak
id.pak
it.pak
ja.pak
kn.pak
ko.pak
lt.pak
lv.pak
ml.pak
mr.pak
ms.pak
nb.pak
nl.pak
pl.pak
pt-BR.pak
pt-PT.pak
ro.pak
ru.pak
sk.pak
sl.pak
sr.pak
sv.pak
sw.pak
ta.pak
te.pak
th.pak
tr.pak
uk.pak
ur.pak
vi.pak
zh-CN.pak
zh-TW.pak
resources.pak
binding.gyp
addon.obj
vcpkg.applocal.log
win_delay_load_hook.obj
xeno.node.recipe
CL.command.1.tlog
CL.read.1.tlog
CL.write.1.tlog
Cl.items.tlog
link.command.1.tlog
link.read.1.tlog
link.secondary.1.tlog
link.write.1.tlog
xeno.lastbuildstate
xeno.iobj
xeno.ipdb
xeno.node
config.gypi
xeno.vcxproj
xeno.vcxproj.filters
package.json
elevate.exe
Failed.png
Xeno.dll
Xeno.ico
api-ms-win-crt-convert-l1-1-0.dll
api-ms-win-crt-environment-l1-1-0.dll
api-ms-win-crt-filesystem-l1-1-0.dll
api-ms-win-crt-heap-l1-1-0.dll
api-ms-win-crt-locale-l1-1-0.dll
api-ms-win-crt-math-l1-1-0.dll
api-ms-win-crt-runtime-l1-1-0.dll
api-ms-win-crt-stdio-l1-1-0.dll
api-ms-win-crt-string-l1-1-0.dll
api-ms-win-crt-utility-l1-1-0.dll
concrt140.dll
index.html
libcrypto-3-x64.dll
libcurl.dll
libssl-3-x64.dll
msvcp140.dll
msvcp140_1.dll
msvcrt.dll
notification.mp3
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
zlib1.dll
snapshot_blob.bin
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
StdUtils.dll
System.dll
nsis7z.dll
content_new.js
breach-notification.html
headset.svg
location-pin.svg
notication-bell.svg
video-cam.svg
yellow-circle-warning.svg
get-premium-keys.svg
oap-results-close.svg
oap-scan-tools.svg
content-linkedin.js
content-oap-notification.js
content-scripts.js
mbgc.mv3.ads_1.json
mbgc.mv3.ads_2.json
mbgc.mv3.always_allow_DNR.json
mbgc.mv3.easylist_1.json
mbgc.mv3.easyprivacy_1.json
mbgc.mv3.malware_1.json
mbgc.mv3.whitelist_1.json
oap-notification-popup.js.LICENSE.txt
XENO_CACHE.bin
default.exc
ccba5a5986c77e43.customDestinations-ms
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
16e613d0-9d5c-4521-a904-af2bfb4b6256
78ae5a41-50ee-4e9c-a4e2-af9d2f226bf7
8f2efd0f-ade6-4d70-8e43-aa686061a8ce
be6c8099-ecf9-4862-a2b0-0821b7d8d793
d41aa132-04b9-455b-b1c5-15662fec8174
f313fce2-232b-4cc8-9d48-4996e50dbaa8
prefs-1.js
prefs-1.js
f_000005
data_0
data_2
data_3
data_1
Network Persistent State
Network Persistent State
Network Persistent State
Network Persistent State~RFe5aef14.TMP
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity
TransportSecurity~RFe5a7b4c.TMP
MBSetup-2.2.exe.crdownload
RobloxPlayerInstaller-VV8VHB6P9R.exe
mbtun.inf_amd64_add82795013a7c3b.ini
1F657678CDAD5400251B323D207EA54F
8E98E754284A422CC3ACAABE73E0D55B
F9C57C8B55E84B295CBBD8CF3D95BF44
1F657678CDAD5400251B323D207EA54F
8E98E754284A422CC3ACAABE73E0D55B
F9C57C8B55E84B295CBBD8CF3D95BF44
LICENSE
mb_A1BC.tmp
memory/1864-822-0x00007FF9CD710000-0x00007FF9CD711000-memory.dmp
memory/4124-11532-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4124-11534-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4124-11539-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4124-11541-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4124-11542-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4124-11538-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4124-11540-0x0000020B55350000-0x0000020B55351000-memory.dmp
memory/4676-663-0x00007FF9CE6A0000-0x00007FF9CE6A1000-memory.dmp
memory/4676-662-0x00007FF9CD630000-0x00007FF9CD631000-memory.dmp
memory/7748-4709-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4710-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4711-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4712-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4713-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4714-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4705-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp
memory/7748-4703-0x0000027FFEA60000-0x0000027FFEA61000-memory.dmp