a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

Analysis

max time kernel
175s
max time network
179s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
10/07/2024, 14:32

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

MEMZ.exe
Size

14KB
MD5

19dbec50735b5f2a72d4199c4e184960
SHA1

6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA256

a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
SHA512

aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP

192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj

Score

7^/10

bootkit persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Runs regedit.exe 1 IoCs

pid	Process
4144	regedit.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3428	MEMZ.exe
3428	MEMZ.exe
2552	MEMZ.exe
3496	MEMZ.exe
3496	MEMZ.exe
2552	MEMZ.exe
5040	MEMZ.exe
5040	MEMZ.exe
2552	MEMZ.exe
2552	MEMZ.exe
3496	MEMZ.exe
3496	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
5040	MEMZ.exe
5040	MEMZ.exe
5040	MEMZ.exe
5040	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
3428	MEMZ.exe
3496	MEMZ.exe
3496	MEMZ.exe
3428	MEMZ.exe
2552	MEMZ.exe
2552	MEMZ.exe
2552	MEMZ.exe
2552	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
3496	MEMZ.exe
3496	MEMZ.exe
5040	MEMZ.exe
5040	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
3496	MEMZ.exe
3496	MEMZ.exe
5040	MEMZ.exe
5040	MEMZ.exe
3428	MEMZ.exe
3428	MEMZ.exe
2552	MEMZ.exe
2552	MEMZ.exe
2552	MEMZ.exe
3428	MEMZ.exe
2552	MEMZ.exe
3428	MEMZ.exe
5040	MEMZ.exe
3496	MEMZ.exe
5040	MEMZ.exe
3496	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
1692	MEMZ.exe
3496	MEMZ.exe
3496	MEMZ.exe
5040	MEMZ.exe
2552	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: 33	3172	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3172	AUDIODG.EXE
Token: SeDebugPrivilege	1912	taskmgr.exe
Token: SeSystemProfilePrivilege	1912	taskmgr.exe
Token: SeCreateGlobalPrivilege	1912	taskmgr.exe

Suspicious use of FindShellTrayWindow 63 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe

Suspicious use of SendNotifyMessage 60 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe
1912	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
208	MEMZ.exe
3480	wordpad.exe
3480	wordpad.exe
3480	wordpad.exe
3480	wordpad.exe
3480	wordpad.exe
3480	wordpad.exe
1912	taskmgr.exe
3428	MEMZ.exe
3496	MEMZ.exe
2552	MEMZ.exe
1692	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3428	1940	MEMZ.exe	85
PID 1940 wrote to memory of 3428	1940	MEMZ.exe	85
PID 1940 wrote to memory of 3428	1940	MEMZ.exe	85
PID 1940 wrote to memory of 2552	1940	MEMZ.exe	86
PID 1940 wrote to memory of 2552	1940	MEMZ.exe	86
PID 1940 wrote to memory of 2552	1940	MEMZ.exe	86
PID 1940 wrote to memory of 3496	1940	MEMZ.exe	87
PID 1940 wrote to memory of 3496	1940	MEMZ.exe	87
PID 1940 wrote to memory of 3496	1940	MEMZ.exe	87
PID 1940 wrote to memory of 1692	1940	MEMZ.exe	88
PID 1940 wrote to memory of 1692	1940	MEMZ.exe	88
PID 1940 wrote to memory of 1692	1940	MEMZ.exe	88
PID 1940 wrote to memory of 5040	1940	MEMZ.exe	89
PID 1940 wrote to memory of 5040	1940	MEMZ.exe	89
PID 1940 wrote to memory of 5040	1940	MEMZ.exe	89
PID 1940 wrote to memory of 208	1940	MEMZ.exe	90
PID 1940 wrote to memory of 208	1940	MEMZ.exe	90
PID 1940 wrote to memory of 208	1940	MEMZ.exe	90
PID 208 wrote to memory of 4256	208	MEMZ.exe	92
PID 208 wrote to memory of 4256	208	MEMZ.exe	92
PID 208 wrote to memory of 4256	208	MEMZ.exe	92
PID 208 wrote to memory of 4656	208	MEMZ.exe	100
PID 208 wrote to memory of 4656	208	MEMZ.exe	100
PID 4656 wrote to memory of 4420	4656	msedge.exe	101
PID 4656 wrote to memory of 4420	4656	msedge.exe	101
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102
PID 4656 wrote to memory of 2556	4656	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\MEMZ.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3428
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2552
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3496
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1692
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Users\Admin\AppData\Local\Temp\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\MEMZ.exe" /main
  2⤵
  - Checks computer location settings
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:208
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:4256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0x100,0x12c,0x7ffb49d646f8,0x7ffb49d64708,0x7ffb49d64718
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
      4⤵
      PID:2556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
      4⤵
      PID:3104
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
      4⤵
      PID:5064
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
      4⤵
      PID:3364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
      4⤵
      PID:4208
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
      4⤵
      PID:4368
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:4784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
      4⤵
      PID:3628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
      4⤵
      PID:1288
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
      4⤵
      PID:3892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
      4⤵
      PID:3264
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:4576
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
      4⤵
      PID:2532
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1756 /prefetch:1
      4⤵
      PID:4336
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
      4⤵
      PID:4316
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5980 /prefetch:2
      4⤵
      PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
      4⤵
      PID:5168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,1610244809332192870,3782267333043322404,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=220 /prefetch:1
      4⤵
      PID:5244
- - C:\Windows\SysWOW64\regedit.exe
    "C:\Windows\System32\regedit.exe"
    3⤵
    - Runs regedit.exe
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=virus.exe
    3⤵
    PID:3056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb49d646f8,0x7ffb49d64708,0x7ffb49d64718
      4⤵
      PID:4348
- - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
    "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3480
  - - C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      4⤵
      PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=dank+memz
    3⤵
    PID:1444
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb49d646f8,0x7ffb49d64708,0x7ffb49d64718
      4⤵
      PID:4488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
    3⤵
    PID:608
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb49d646f8,0x7ffb49d64708,0x7ffb49d64718
      4⤵
      PID:4012

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\SetExpand.cmd" "
1⤵
PID:2700

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f8 0x4e8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:212

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\142b5ee8-e422-4145-93a4-7cfc8e62e3c3.tmp

Filesize
6KB

MD5
0ede111d397a89582df248dae7c843e7

SHA1
34446041d518b57961f074b1af49b2078c6c8d54

SHA256
8b21b72d135efa292b5023c9a1580c97d5da0986916cbd663fdcf8b26150e566

SHA512
222d5ef7ad41757b85a9e61a2a139f80105ca90cadf1115ba99cc0e00237488e9f25048607d7b3d8f7a65143d7008b6a9d17cc44bf3779098155181084d976ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
24KB

MD5
87c2b09a983584b04a63f3ff44064d64

SHA1
8796d5ef1ad1196309ef582cecef3ab95db27043

SHA256
d4a4a801c412a8324a19f21511a7880815b373628e66016bc1785a5a85e0afb0

SHA512
df1f0d6f5f53306887b0b16364651bda9cdc28b8ea74b2d46b2530c6772a724422b33bbdcd7c33d724d2fd4a973e1e9dbc4b654c9c53981386c341620c337067

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
70KB

MD5
6b9d801ab25cdb907519f89be9615d0d

SHA1
870aa8b7f32c847091a9929effcad3b6b9964aab

SHA256
bf1e4af33dce5b0a36f22333ddd8d3e8b353451191add0961c98bcd848b820f9

SHA512
48634aa1835f184d8c82aff50b4c83348c5f66426e9319d8f967995bc42be244128856d2bcd1b24805d515d5381cd9e63e0768aab2ca749648ffadbe280274fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
353KB

MD5
8329a33937fde0d69aebd8b8bd4dd1c4

SHA1
85a67927d65a470c828f679ad64bb09a85e457a3

SHA256
6c45e39dfc5439e7947a15865f5b1d9b6edff04fb74f3c7d611e5b8b647137f2

SHA512
652e9b4a0065ac6e5fb3ab890b108d95760fbea98e5a5794d165355087755e362a91c1c392dbd7bfa70c4079a8e2d6564d96f899fce2083190c74f6ddd7ab3da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
107KB

MD5
9b192922cbb0987c3d9b2ff8911267a5

SHA1
d5e3b5e7e33a04cefda5194e8c5208bb394e5925

SHA256
7dec200a87de8aeec4dc118497e79511a72151c8efe24f139d925dd946d02c05

SHA512
052680c3523ce4c284fc6d423e140b79d57bab678df8d5668f6cbf22679e574c1dd4a5668675c6be0571acd838078e34db6aaa3ce4721d047b4e28916ad9dca7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
744B

MD5
c4a0383910f39c70b1d1a0a747a29875

SHA1
9af7a65e0d7b2c9b4e34ba7c4bde23d115b5eaa9

SHA256
bdfac6274a9d50dbf3d56cacbdae29b396a9496b851526d77fcae53cad3f6357

SHA512
c49c22dc6e2da5c4b1e41bc60f66dcf5550e42a6ae3097ad36bab7415a48e1c52d214f97c1b38045e86a9449e6d4f902929813d29cf9a44d2a79e684f2525c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
981560e630233541c17968428ce1362a

SHA1
765d206bddf3e31f487222b59f13ee4192387523

SHA256
0091cb57c43b414547d6bc79a0bee730dc68ee69d1323e249acd85abbad5157a

SHA512
1bf2518f5303a249b6005cf4e4557e9f91b87a317834ac0560129aa4eca7cf347d7ad267a21b12e663f3819305d2481eda1633aa86a6f78fe926cba4d5b6166c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
106734310e6a3eff5773e4345d3d719f

SHA1
1aaa6cfb1fb0616fe840d548afdd460548cc4766

SHA256
5a0163e5de71f0c5a9b51c4fd49eedd4a63ed944d421ad21d3bd7b9b755dcb6a

SHA512
14718b890a8aed64e3e0107ff7983969c73c84a324ac8a408b6f2832cddb45bdee48e2fed061feaabf1c5a17ec1934a7895686eebe92bd3aa1770fc5b87d1c57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
73b0985e9525025b50d50dd417d2b494

SHA1
43ac99eedffc893d596bd7ec2cf6a5cbce4771a7

SHA256
7cec3ec8014e83809f1548adf73583a23ad90bb22cf9cf0770e6fde5bb143349

SHA512
5593a83a6833c8c342e97ed71fee0820fa9bf64f410bdb432f7a088148bf82783fb587529451240d2c66b97a7ea029c51fe05afe0dd5cf6c94223d438d8ea8cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f8b56d0163df0b8148ea53b6600ad4d6

SHA1
3f94f42a156366b09cbca66ceacfe250f7057e40

SHA256
2869ae09cc57bb2d580c2fc5f7e2747fc70d8a832e99ff2a59cb1a0305f39215

SHA512
59b1dbf8b2eba8ef42c3dfc605130d860eff89fb744d005943c4f8b13d79e0a1710fb1aa5269bee6cf033df15ee370fbcad093ab08b4b46b5607d7f330f85778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
04fb0f6bfec3b5682e154b95864d2148

SHA1
7029a3395762f8a20af1b03c4499f122d3ae827f

SHA256
dcff391417b34567717bcfbfe44b0abf5541073c30de0557d5c61da5acd18d2d

SHA512
ce31516081acdfc050373f33a5296dda2aaedac532a649de4290871a90cff4d8a871e0783df3e44c69633615ff5060eee4b30c9e094e5fa96640ea2627068084

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
43f01c1c5fb609d44dfbb46248832b6f

SHA1
ca8a6f0e75ff8d8b558fc8b3e79dd501b94a88d6

SHA256
d65dc74896b204a607035accd3e70ef4faba5c849e3edd71794348b5215a7021

SHA512
eb2805424febc986acefb50a3586c8435667205e95e8efa34752976c7df4cfd64b371add01f833e166a782c131a3265a679e344c298bdc178092db32f142dd13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bf911d2f2bba5e0b1f12be419235fee

SHA1
7fc7760e82a49a0dc8c6289a955e41dbc5a3c8b7

SHA256
fa6df482e7f0632c3229acd39ca34cc73f852fc6d2f746c35a2614952223c98d

SHA512
eadd2db3e0d7f80f940413928e4c57029c9829d46cc6b2b4cac688d978958b91c28a1ae7cad647107c2cd14852f0f65005fa75dce9173f4698d7f4d38fe53dfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
839bc4107af213342d0b686f8d89d468

SHA1
152ffefc545b476247efd7477f934b168025ba45

SHA256
86964a408a5f37cb77e93c90aeb075f5d2bc2a9fbc9e4784c72a904d46c7ad48

SHA512
1a82cef8376e79fa6bf73e15703426141bce0fc073b925655cdc3cfc7aef383a2a6c31cb0024f86116f120ce920347af4f77dff01a8fca4f4016c3c094fe94f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee969f9b0d1b4d4a98f78042da12c7ee

SHA1
473c86b7b5978ccc5351e490cdfea3f76d5596dd

SHA256
d99ce91f24028850ccf1b2aeb865f1c3019ba0bfc57d484a1aeecc90c79b6ad0

SHA512
08d64c1637b2f09885f1f7c3c18f78956c88f227090138b5ace47dd82020b2488b1e6fd8b525b2f6b3ad2e7355760123f5929dbbf361d61a3df6d712acf9f85b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
202B

MD5
70b599aa915309aac9c895673f3c9feb

SHA1
ad421ee58fb94c7fc4469a879def9ef8608d9df3

SHA256
27d70a43db48ecb494541296066ca76790a104e7d9b75a48fe073d61426e0df2

SHA512
344e92e40c95888a8727c9de2af8b7f564c080d342644bdbcb49cd025f84089d84063685c1336b88e51dd845bb09b47438bd7f9ff279b87b7019af945a6a43ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5a2d5b.TMP

Filesize
204B

MD5
1700aea02f34cc0643c2611a876dd7cd

SHA1
192cc035d8a0553531094012869b29e491b60ab4

SHA256
3385701ccc62207628dd2c2f89edf2c83682edcbb7ea04adf62da032c0c89b0b

SHA512
d646bc19fbbe614126337c041be76e00b1d08c754d9387e6819bb51402ea09ef67b042b861b5e484aada8699b2c6d114ec0f8b983ade272af71cff1924cf1f14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3a01a8e2181bd64c28ed20f0084a1222

SHA1
7c1165265c8c5e3a65ec3d08f7a11ea0cc5b640e

SHA256
542bac082af24a166eaa6e1591d066a00129343c8700ba2bda1a3ef382dbf137

SHA512
66c9cbaaf0c5dd0e7f4c69f149eabab425f8b78422d6dba1543df9653be893ac62d780fda13ce36b15000743238c6c1e57fca25bc7fe43ff79d4cafcaf8133cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
56e663cb882fe25e539186351ea09572

SHA1
df3e5cfc348da0ad3e5b1557f719521ca638aa0e

SHA256
7937e17ea42ac3b376360339b8608c8ce4d0c12f1b9dd9c65b5abbcc1bc1434b

SHA512
8f314ea5e33f292bd26006a0e795d2a5fb245f26964e1f412ca6cdff54ea19423a048e317693db749e7cfdd585f9ad21f006527e79f84ae01dbdb2510ea91e55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
2e4092cbfd44b24a1afe464faa26c15c

SHA1
7deb5debfefd406dfa7cc853ccd15aab9cc3b288

SHA256
3a0248f4a679319c816c226e84bd1b0b388e2ca32f7acc3eb83e02b11ec397f6

SHA512
82d28062e0dacf8668997cb7835c1fe97ad4b644c52301a8a756efd76307708e880d9f9da4b55aa6d258c7e490fd965906a1202b96212040deec38633ee2d4e3

Download Submit
C:\note.txt

Filesize
218B

MD5
afa6955439b8d516721231029fb9ca1b

SHA1
087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

SHA256
8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

SHA512
5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf

Download Submit
memory/1912-315-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-310-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-311-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-312-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-313-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-314-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-316-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-305-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-306-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download
memory/1912-304-0x000001A10B290000-0x000001A10B291000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads