Analysis
- user interaction
yes - max time kernel
699s - max time network
901s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
30/10/2026, 17:47
General
- Target zahid_antivirus.zip
- Size 349KB
- Sample261030-wdcepsez8k
- SHA256 799f62a1ccde676df8799392dc92d428d47c8243e5dbe7a1b90ec244c6eedb83
Score
10/10
Malware Config
Signatures
- Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
- Detects KillMBR 1 IoCs
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Executes dropped EXE 2 IoCs
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Drops file in Windows directory 3 IoCs
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Modifies registry class 64 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 21 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\zahid_antivirus.zip1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffd6c03c728,0x7ffd6c03c734,0x7ffd6c03c7404⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,1298830505809543078,5384922712510522282,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:114⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,3854017849889054248,14234264717945585240,262144 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:24⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,10339045938774823249,472437281239915382,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:134⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3372,i,7217371196320693399,5200514384158055395,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3368,i,18347627051751598308,1030683412180896149,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4748,i,12820253432288761827,16551977653441161082,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4788,i,5776423992152495049,9730567123488889354,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5424,i,18066736226417934693,3397216362282830860,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5508,i,10222232247382044968,9217960286585011025,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5528,i,3061028550022908314,17789498470188837040,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5876,i,1667767184594909775,12601194140231842946,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5856,i,2483242599862885292,15251270103575048175,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5520,i,9557253150936677493,5435277873059415150,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6396,i,15456737409278761818,15646414237698902932,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5680,i,3319014829882307570,11233502424066161963,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6572,i,14047799762682073944,2380617527681415043,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6696,i,3025256567709698505,6832260834369130400,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6296,i,1968137455011757436,14305769698533152006,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4720,i,1642775356589069422,7955450520101281906,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6316,i,4723470373433172668,4400560400238637489,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6312,i,9218418421229544159,9887023934420552378,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:94⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4740,i,15820204567842673357,168128935961086660,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6536,i,11078636984865268997,9810554741993730809,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=4344,i,10030903279471502080,12116845103030216572,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3588,i,8211762485482794529,547094055557319920,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,11952053421168872818,14954176080125210871,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:124⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6016,i,3821536276766457357,14003259162181688821,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=256,i,10767953203396136342,15090919549029430993,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6480,i,16694191226111815954,5145305359526894591,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6424,i,1804408721134086036,10380700156249021099,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6472,i,9948838721997814934,8842120223472319005,262144 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:104⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4696,i,15115487378566415670,2883421118235277052,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6528,i,15597932620472398367,2568978717473920957,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6952,i,16474850540770872175,12734384794854159429,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7052,i,3981758699828868860,10656364793784104588,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=5732,i,7931985707384694147,370323097806902532,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=3772,i,24372601637083688,3110049712772165322,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:14⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6932,i,5032681244864151575,6570586979877221237,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6300,i,14734195524608506477,674414357510568543,524288 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:144⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=6248,i,10343109357287568491,4005796926240368150,2097152 --field-trial-handle=2024,i,5924908002098514176,9461941186169995978,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14⤵
-
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe"3⤵
-
-
C:\Users\Admin\Desktop\zahid antivirus\setup.exe"C:\Users\Admin\Desktop\zahid antivirus\setup.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"4⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Apps\2.0\XN60QWE3.OT8\9XM9V203.BWN\zahi..tion_bfa37e77f02693f0_0001.0000_de554d170c73bfad\Zahid Antivirus.exe"C:\Users\Admin\AppData\Local\Apps\2.0\XN60QWE3.OT8\9XM9V203.BWN\zahi..tion_bfa37e77f02693f0_0001.0000_de554d170c73bfad\Zahid Antivirus.exe"5⤵
- Executes dropped EXE
- Modifies registry class
-
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\memz.by.iTzDrK_\" -spe -an -ai#7zMap27188:92:7zEvent175333⤵
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004C4 0x00000000000004D41⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CaptureService1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
zahi...exe_bfa37e77f02693f0_0001.0000_none_dc707bb7244cb679.cdf-ms
zahi..tion_bfa37e77f02693f0_0001.0000_none_03fad10186989100.cdf-ms
32e07c0b-657b-418a-a52b-0fd9bcf11ec6.tmp
36118147-fb74-43b4-901a-ebdb9716ad7d.tmp
3ebadd60-b81f-49bf-9907-60b66cb9e66f.tmp
705ff439-be99-4b50-884c-1a51653b106a.tmp
2749015c-77d7-4640-adcf-56b90542a68b.tmp
33bf88cc-3c60-4a73-9c8c-935f868054cb.tmp
4523f42c-e2df-4649-962d-9c8e76a06026.tmp
467577ff-4b4e-46b6-885b-687021543d8a.tmp
6120ac11-0a11-4b83-8f4b-5e2a3147df94.tmp
630b41f6-216f-479b-884b-8b25601102e5.tmp
989d00e6-c293-4afe-ad0e-d5c705bf189d.tmp
f_000004
f_000015
f_000017
f_00002c
temp-index
temp-index
messages.json
craw_background.js
CURRENT
MANIFEST-000001
MANIFEST-000001
3d2be97b-b6e8-4dca-813a-f6aacd81f93e.tmp
7cd616e9-7fe6-4e14-ae7c-afbf5f229fb1.tmp
c43a8d82-9108-4905-a723-73d2d3764b9c.tmp
d3879581-d610-45ad-b776-ec4d45549879.tmp
temp-index
temp-index
the-real-index
data_0
data_1
data_2
data_3
Network Persistent State
e21fe242-ed3c-4368-b864-2dda9a7e397a.tmp
bf534bcf-099b-4eb3-a977-bdbeeaedd643.tmp
Local State
fa59ea64-3f8d-4b7b-831a-e0a22692861c.tmp
prep_Activatable Class_Hermes_perf.cache
0d1fead5-14c6-4a2b-a921-876b07a3142c.tmp
1326096460_Add.ico
Zahid Antivirus.exe
Zahid Antivirus.exe.genman
Zahid Antivirus.exe.manifest
messages.json
f01b4d95cf55d32a.automaticDestinations-ms
Zahid Antivirus.appref-ms
Zahid Antivirus.application
favicon.ico.deploy
setup.exe
6aefa88a-3d38-44d8-92f8-bda6e122de36.tmp
memz.by.iTzDrK_.rar.crdownload
Geometry dash auto speedhack.bat
geometry dash auto speedhack.exe
memory/2028-68-0x0000021404450000-0x0000021404470000-memory.dmp
memory/2028-194-0x0000021400430000-0x0000021400613000-memory.dmp
memory/2028-35-0x0000021403BF0000-0x0000021403C10000-memory.dmp
memory/2028-54-0x0000021403FF0000-0x0000021404010000-memory.dmp
memory/2028-36-0x0000021404090000-0x0000021404190000-memory.dmp
memory/2028-22-0x00000214001E0000-0x00000214002E0000-memory.dmp
memory/3124-1090-0x000002375F5C0000-0x000002375F748000-memory.dmp
memory/3124-1089-0x0000023744E10000-0x0000023744E18000-memory.dmp
memory/3124-1126-0x00000237613C0000-0x00000237613F8000-memory.dmp
memory/3124-1095-0x0000023746C90000-0x0000023746CE0000-memory.dmp
memory/3124-1110-0x000002375F9F0000-0x000002375F9F8000-memory.dmp
memory/3124-1111-0x000002377BDB0000-0x000002377C072000-memory.dmp
memory/3124-1112-0x00000237614C0000-0x00000237615F6000-memory.dmp
memory/3124-1113-0x0000023761430000-0x00000237614D8000-memory.dmp
memory/3460-1204-0x000000001CB40000-0x000000001CB8C000-memory.dmp
memory/3460-1203-0x000000001B660000-0x000000001B668000-memory.dmp
memory/3460-1202-0x000000001C9B0000-0x000000001CA4C000-memory.dmp
memory/3460-1201-0x000000001C2E0000-0x000000001C7AE000-memory.dmp
memory/3460-1200-0x000000001B5A0000-0x000000001B646000-memory.dmp