Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

07/01/2025, 22:05

250107-1z1rms1kat 3

04/09/2024, 21:58

240904-1vqqwaxbqr 8

04/09/2024, 21:55

240904-1s3yesxbpl 6

04/09/2024, 21:38

240904-1hjf2awhql 9

04/09/2024, 21:22

240904-z8eebsxfmf 8

Analysis

  • max time kernel
    231s
  • max time network
    238s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/09/2024, 21:58

Errors

Reason
Machine shutdown

General

  • Target

    https://www.google.com/?safe=active&ssui=on

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Downloads MZ/PE file
  • ASPack v2.12-2.42 1 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 3 IoCs
  • UPX packed file 2 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies registry class 4 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/?safe=active&ssui=on
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ef2a46f8,0x7ff8ef2a4708,0x7ff8ef2a4718
      2⤵
        PID:3064
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
        2⤵
          PID:2556
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:224
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
          2⤵
            PID:2940
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
            2⤵
              PID:2160
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
              2⤵
                PID:4888
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
                2⤵
                  PID:1764
                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
                  2⤵
                    PID:4468
                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:4236
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
                    2⤵
                      PID:2984
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
                      2⤵
                        PID:3200
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5588 /prefetch:8
                        2⤵
                          PID:4000
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5600 /prefetch:8
                          2⤵
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4148
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
                          2⤵
                            PID:2524
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
                            2⤵
                              PID:1848
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
                              2⤵
                                PID:3468
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
                                2⤵
                                  PID:2004
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
                                  2⤵
                                    PID:1956
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
                                    2⤵
                                      PID:3776
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
                                      2⤵
                                        PID:5328
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
                                        2⤵
                                          PID:5960
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
                                          2⤵
                                            PID:6036
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5812 /prefetch:8
                                            2⤵
                                              PID:5624
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
                                              2⤵
                                                PID:5632
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
                                                2⤵
                                                  PID:1644
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 /prefetch:8
                                                  2⤵
                                                    PID:5448
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3240
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:3632
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3796 /prefetch:2
                                                    2⤵
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:1652
                                                  • C:\Users\Admin\Downloads\Avoid.exe
                                                    "C:\Users\Admin\Downloads\Avoid.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5016
                                                  • C:\Users\Admin\Downloads\Avoid.exe
                                                    "C:\Users\Admin\Downloads\Avoid.exe"
                                                    2⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3956
                                                • C:\Windows\System32\CompPkgSrv.exe
                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                  1⤵
                                                    PID:4904
                                                  • C:\Windows\System32\CompPkgSrv.exe
                                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                    1⤵
                                                      PID:1860
                                                    • C:\Windows\System32\rundll32.exe
                                                      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                      1⤵
                                                        PID:1668
                                                      • C:\Users\Admin\Downloads\Avoid.exe
                                                        "C:\Users\Admin\Downloads\Avoid.exe"
                                                        1⤵
                                                        • Executes dropped EXE
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5212
                                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe
                                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:5540
                                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe
                                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"
                                                        1⤵
                                                        • Enumerates connected drives
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:3160
                                                      • C:\Windows\system32\AUDIODG.EXE
                                                        C:\Windows\system32\AUDIODG.EXE 0x50c 0x33c
                                                        1⤵
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        PID:1892
                                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Flasher.exe
                                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Flasher.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:6036
                                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ArcticBomb.exe
                                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ArcticBomb.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:4444
                                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe
                                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"
                                                        1⤵
                                                        • System Location Discovery: System Language Discovery
                                                        PID:2592
                                                      • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\000.exe
                                                        "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\000.exe"
                                                        1⤵
                                                        • Enumerates connected drives
                                                        • Sets desktop wallpaper using registry
                                                        • System Location Discovery: System Language Discovery
                                                        • Modifies registry class
                                                        • Suspicious use of AdjustPrivilegeToken
                                                        • Suspicious use of SetWindowsHookEx
                                                        PID:5712
                                                        • C:\Windows\SysWOW64\cmd.exe
                                                          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:2528
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im explorer.exe
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5400
                                                          • C:\Windows\SysWOW64\taskkill.exe
                                                            taskkill /f /im taskmgr.exe
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Kills process with taskkill
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:3924
                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                            wmic useraccount where name='Admin' set FullName='UR NEXT'
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:5440
                                                          • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                            wmic useraccount where name='Admin' rename 'UR NEXT'
                                                            3⤵
                                                            • System Location Discovery: System Language Discovery
                                                            • Suspicious use of AdjustPrivilegeToken
                                                            PID:4796
                                                          • C:\Windows\SysWOW64\shutdown.exe
                                                            shutdown /f /r /t 0
                                                            3⤵
                                                              PID:3920
                                                        • C:\Windows\system32\LogonUI.exe
                                                          "LogonUI.exe" /flags:0x4 /state0:0xa397c855 /state1:0x41c64e6d
                                                          1⤵
                                                            PID:4832

                                                          Network

                                                          MITRE ATT&CK Enterprise v15

                                                          Replay Monitor

                                                          Loading Replay Monitor...

                                                          Downloads

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            ecf7ca53c80b5245e35839009d12f866

                                                            SHA1

                                                            a7af77cf31d410708ebd35a232a80bddfb0615bb

                                                            SHA256

                                                            882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

                                                            SHA512

                                                            706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                            Filesize

                                                            152B

                                                            MD5

                                                            4dd2754d1bea40445984d65abee82b21

                                                            SHA1

                                                            4b6a5658bae9a784a370a115fbb4a12e92bd3390

                                                            SHA256

                                                            183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

                                                            SHA512

                                                            92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

                                                            Filesize

                                                            212KB

                                                            MD5

                                                            08ec57068db9971e917b9046f90d0e49

                                                            SHA1

                                                            28b80d73a861f88735d89e301fa98f2ae502e94b

                                                            SHA256

                                                            7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

                                                            SHA512

                                                            b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

                                                            Filesize

                                                            64KB

                                                            MD5

                                                            d6b36c7d4b06f140f860ddc91a4c659c

                                                            SHA1

                                                            ccf16571637b8d3e4c9423688c5bd06167bfb9e9

                                                            SHA256

                                                            34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

                                                            SHA512

                                                            2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

                                                            Filesize

                                                            41KB

                                                            MD5

                                                            9101760b0ce60082c6a23685b9752676

                                                            SHA1

                                                            0aa9ef19527562f1f7de1a8918559b6e83208245

                                                            SHA256

                                                            71e4b25e3f86e9e98d4e5ce316842dbf00f7950aad67050b85934b6b5fdfcca5

                                                            SHA512

                                                            cfa1dc3af7636d49401102181c910536e7e381975592db25ab8b3232bc2f98a4e530bb7457d05cbff449682072ed74a8b65c196d31acb59b9904031025da4af4

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

                                                            Filesize

                                                            70KB

                                                            MD5

                                                            4058c842c36317dcd384b6c2deaa8b95

                                                            SHA1

                                                            1085ddb12b29b79ffe51937ba9cd1957e5e229b4

                                                            SHA256

                                                            0e562969cad63d217848a5080273d1745dc4277d210b68a769c822f2fbfd75f6

                                                            SHA512

                                                            435a67024811360b12339e3916945b0639e2d9319e9d540b73e093848a467b030e91e01917b7fb804eb756dabce2fe53c2d7ea586554ee6cfee70e652a85924a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

                                                            Filesize

                                                            19KB

                                                            MD5

                                                            76a3f1e9a452564e0f8dce6c0ee111e8

                                                            SHA1

                                                            11c3d925cbc1a52d53584fd8606f8f713aa59114

                                                            SHA256

                                                            381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

                                                            SHA512

                                                            a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

                                                            Filesize

                                                            65KB

                                                            MD5

                                                            56d57bc655526551f217536f19195495

                                                            SHA1

                                                            28b430886d1220855a805d78dc5d6414aeee6995

                                                            SHA256

                                                            f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

                                                            SHA512

                                                            7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

                                                            Filesize

                                                            84KB

                                                            MD5

                                                            74e33b4b54f4d1f3da06ab47c5936a13

                                                            SHA1

                                                            6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

                                                            SHA256

                                                            535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

                                                            SHA512

                                                            79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

                                                            Filesize

                                                            1.2MB

                                                            MD5

                                                            7026721097c2f006156832039de8e081

                                                            SHA1

                                                            d5e4492b4c91315efdb439bdd37c51b3686012d7

                                                            SHA256

                                                            e8b9d92852b1e7f7c9d65a15a0eda913e1de63d1b6db3acc27b948768fdd1a36

                                                            SHA512

                                                            01924a654375a1e592ac6a952917b50e6187ceec41101cb2068b8618d8e582b8c0658ed7459afe13d557e7e5252606d1cdc595fffcdcda1537037b254801c538

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

                                                            Filesize

                                                            43KB

                                                            MD5

                                                            209af4da7e0c3b2a6471a968ba1fc992

                                                            SHA1

                                                            2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

                                                            SHA256

                                                            ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

                                                            SHA512

                                                            09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

                                                            Filesize

                                                            73KB

                                                            MD5

                                                            cf604c923aae437f0acb62820b25d0fd

                                                            SHA1

                                                            84db753fe8494a397246ccd18b3bb47a6830bc98

                                                            SHA256

                                                            e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

                                                            SHA512

                                                            754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                                            Filesize

                                                            27KB

                                                            MD5

                                                            ac4c4890fa7b92d5f076e94b226f42af

                                                            SHA1

                                                            15af973f75d3440b01f9b849d8a2ab7de4dd7bc4

                                                            SHA256

                                                            a2f3c4f186f667d67c725d82bf27ccdcb0f760447fb3ec2abed61f2107105051

                                                            SHA512

                                                            cd38b78aab26318c948e583ed3db13c21c76c9d83141f3ce5c45a3c74733e6e9e1329ca5afd4fd8910bc9f9536143ef491e74c04e10a5a38734d4c56d26e5c9b

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

                                                            Filesize

                                                            18KB

                                                            MD5

                                                            5c73e3854f194383c96b8aa03078f1af

                                                            SHA1

                                                            42a2f5e77043eb2cec42a9b5067968396bc63372

                                                            SHA256

                                                            756ccfdfde5584770db79aa215a1442f1a472fe299b337d6b04e5fc84a02c2ca

                                                            SHA512

                                                            6bc904ea793bbc13a7bea5e8a4891926fbb4f8854d213ec2650effdbdbbb3e33b1ae66fbfbcc7a21c82dd4b2e6927f45c0df984a5e13a1aaf4259cc8608ec02f

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            fb851374aaab43caa835dfc75c4c56ad

                                                            SHA1

                                                            9a7115d8f706a405b2e3ec9438fab1750d51cd5d

                                                            SHA256

                                                            2b27ebd9c48ef02ab138a3784428f7640bd03e89e1b0db871d42fca98efeb3de

                                                            SHA512

                                                            f384fb52e2a8d4627447a670cacfe57a09d5888a03537b40a1f2e6199e61e9bd04fb2608816c1992cbaad439159e197e9c7f252b60d47dfdc6f27ed335794295

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                            Filesize

                                                            4KB

                                                            MD5

                                                            cdafbe2f00ff505aec87050a5c6714dd

                                                            SHA1

                                                            425b6fcb8db2cfaf1f7ed934ac7ea78903676cd6

                                                            SHA256

                                                            777da4cb574cec65ff624d6d2f8880ae42ee4d315ad495711fdacdce9fa023bb

                                                            SHA512

                                                            a5e4d97b55abaf2df71a59de4adfc0b442c2f6cec6fd51b62963657f481cc9f0c0881a85c7b916e8e82117e6d1d35f1f6991b0284aba712d55d11ad50dcae424

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                            Filesize

                                                            2KB

                                                            MD5

                                                            1850e494209916e214cf7521f9ac5057

                                                            SHA1

                                                            7cf209c9fc439cea4ba0afd7af5a4d5e20d25e86

                                                            SHA256

                                                            4c91b08a1561792f36c53ef3689e4b356dfa6b8cd3060828f8059f6aeaa26f63

                                                            SHA512

                                                            49c9252f0ec0ea76c58dd5edf37a3ff26739bc900132991da970739775d010cb154c222e01e645108a139a87153e0628fd3f922fb1ae7b93b9ecfbd49620f919

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            0ca0e92cf868d8d5f16771bcee3bc6b8

                                                            SHA1

                                                            d615ebdac6583c7bc4730085056b3384124d53a4

                                                            SHA256

                                                            eee6a1ead834b7a2c41a4dbb0acf4121f3c69877919c07357e92f56e3cdf5b11

                                                            SHA512

                                                            1a7e255ec19722f8db4c415974fcb6e65b5332e86a65529f6d6ee184d266f32d2c4e4a6d5f7d651dca6714695f11414d54ad5ec8febb542bf75d634991eff23d

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            eb288c0de011ebee379ae68b3ca0f84b

                                                            SHA1

                                                            d25d27d34741283b5964ab1a1c0ea195bd756c7c

                                                            SHA256

                                                            4fe9af31370e3db32bedc90fb80f345bc672df2f1197a2091009ee73f0efcee5

                                                            SHA512

                                                            be27583cf0a68e8068505a5e91b525a6918e7d573246a452374b2c0fc338c85e82533f9c5f64db6b9fac0128a1850636c061a8b364e50598b610444041806662

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            2c0b78b0fd1218abf886c76054c1a51b

                                                            SHA1

                                                            03114f201ba1a31a451c3ff18df3db8d3dc5fa5b

                                                            SHA256

                                                            6fc3271f368a8f8b95633100ddb877bf2600e07e9b77bbca0832e539d72982af

                                                            SHA512

                                                            46059a61657bc7e41c961b872c45c17150d02dfb4de6ced661a8cb3177eb1f802b51cbf5e8421d48629806eb40a2879e0aa8515bded15292012105787e648a21

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            5KB

                                                            MD5

                                                            8513fb4f4dba6d153157e4b76a87bbf2

                                                            SHA1

                                                            a0cc4ca0009f9cd9fb0c261fa426c9908418d0bb

                                                            SHA256

                                                            bc186042f24a856cb493468aefdac883688b468649cca7d99614cc210fe4ff8c

                                                            SHA512

                                                            647de139e1c6df145f72afda5a3bf3c42a2af1282e7e94e4f08ff644931b598a0f59026c171ee01e7f36b7948c433cd57e10b33659581247d32c60a4bf4991c0

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            981e4c183e2296c40a3a7a064dea093e

                                                            SHA1

                                                            ebf8230761dcd2e9bb110fe29ddbc47d4000df5d

                                                            SHA256

                                                            c1a3266caea2c47b1458b62cd5da2d27554a83c1575384282eba4f73c30dedcc

                                                            SHA512

                                                            a06398d738c5b5ff164fc9a63d8d78717ef3bfb4272e65e8ea21d9dc303fb97123adc9ced2d7a1a51e405e994e3908277b728674237816fa0a111b3b162347e9

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            bbf17641483b429a73a10423e8798868

                                                            SHA1

                                                            6d27d139240f19a0ac09181959ba60b9a589a2da

                                                            SHA256

                                                            f64709d47d5869dd816a4a696ecd0e6921e94bcca1c1db9519a7394788737b2d

                                                            SHA512

                                                            d356462e2e335153d7b99ce7f6c96f9bc74f5b324489243d5bbe26cf1116ca17e0b17ea8ca18ac4ee6e769a81e65c411c80e02e7565188542abe5c05ad4b9496

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                            Filesize

                                                            7KB

                                                            MD5

                                                            96df6e5e8e885b9f5f2cd1d665a8189c

                                                            SHA1

                                                            81c2b1cdfac5ef26d468fa11837f185e9d2adf4c

                                                            SHA256

                                                            46a6d6c06de8601c4aca75b81ca040d23c6d06eecdf8957c35506863a00f8f57

                                                            SHA512

                                                            2223650ddf3daa63a884843b3a6ff62bfa591f617f0f9478945fa3d99b8ef29a43c27dcd79df7ac37acb6b7c86f08c01a5a4de0117f737441d7a06c4339af14a

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            7f8ad7802579b7b224c05521843eb430

                                                            SHA1

                                                            ee0f5181345de6452566f2354e36750985294e58

                                                            SHA256

                                                            8482c9d6c49f3e2a08761cdaa49dc71ba91b6576317b595cf38145f20a9f0ce3

                                                            SHA512

                                                            da590f7f7de29b9a10a7569965d6b77d992bbead05ed745b9d72d093d3d531f1019689166046083c39d3d48737eabb2f78e6fe115d49219ff23b594f1b4e02c1

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            41481645bd503ff0e04d2c46cb06724b

                                                            SHA1

                                                            fd5fa96be163d8deb05dc1ff6d6303b8f6aa5eb3

                                                            SHA256

                                                            d7508b75270b3952bfbf9fd6864a79aa6b01784f84e8fc2302458a4ed1d8a6f4

                                                            SHA512

                                                            cef0c386c65fb3b705d4e178737daee8840dacfcff2700778d1a4295ecb03cf3a419ddae27c7b1332c434769b87cf12c33f908ffffe2201cbee00ae5c370ca6f

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            706B

                                                            MD5

                                                            21e6a6d12680e64f3dd527b7e2b7991d

                                                            SHA1

                                                            72bcb90cdf8e5ee430543e58600cbd702e700896

                                                            SHA256

                                                            a282766de682a1536354ab65d5bbad2ef6e5cd984a18f87868774622dfa62fda

                                                            SHA512

                                                            7098be494ccad3ebbd1e8b8639200621567f477cacd9cccd89152cd2d859e4548fb6c099b44a1ca398012a8fb814a90eef6341acabd61f445371fb6d69c6b594

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            939466f6fb7109856c3791c0909e0f5a

                                                            SHA1

                                                            a998ac19a1a5ef770cd0a08565ea2e872eecf7a0

                                                            SHA256

                                                            93079309d75f364a877ac0a140bba7fda43286ffa33780cb98a03dd1faecfa28

                                                            SHA512

                                                            b524459701f2ba8ee8917ce85cebf17988653d8591200e5ecb7756cf2e81b1b4bdb450a731ef935029fcb9ca7856670f8a4e7b5d7d597e16b57695a4dd9c9ffc

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            98b61e2087be212acdecf8a5dd031c53

                                                            SHA1

                                                            8e6b47537c3b83e09f83654ac7e9b8d3f29d8d4d

                                                            SHA256

                                                            20107394c96cc8a72ab5a06a504002a61700fb0e5d4a818fdf3eb97eceb37177

                                                            SHA512

                                                            c797584039b2a3b32f05d363b4e24e2687baacce1dcdc0e2a70b25377964f4c7ad735fd4600d26d94fee5c58db25f04e03a677ac27b0cbde466ef5345b0b312c

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            eea32ad9b956a1c07b682d7cd5f174e1

                                                            SHA1

                                                            3ba034f069419ba721598b8b41a5dee22d3cd9e5

                                                            SHA256

                                                            470d1acee8855fa70144a84b1e6cb4840c3f826b0b11855c4c8a8e5ad602191c

                                                            SHA512

                                                            ef363f0b586c4097d3c24a3db02dcddd514488947fb423e400e5e799d5b6c50a8662d50aa0cb281d17e904e23ec52318fcfd73ad00aac5ed65b7fb0a68736dfa

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            62384e4379375c01ea40878df14d9a5a

                                                            SHA1

                                                            19eb9a77e3c1bc757d4b0e572ff584f062818906

                                                            SHA256

                                                            fe70aa2bcd43e47972e42e11f17bd180f70e29e439f14a338d0c55d144fc6a45

                                                            SHA512

                                                            509740fbc4e1597c692e8e85c3fbf7e9f82a249243abb0b4077344879c4088877714881eb00868687d8701d4837cae3c4fd186f4238a953fdbedead7a4fa066d

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                                            Filesize

                                                            1KB

                                                            MD5

                                                            d7111e47b64cf87456127313e52ca1a6

                                                            SHA1

                                                            e8acf833c7c394bbcb03b623c30d290b78d5ad03

                                                            SHA256

                                                            cdef1bc8711a43711e6ca87c6a3cebdf66848b792d735bfd8a8138be801fef72

                                                            SHA512

                                                            d71a62ab0ac42de1700b86a7dae09cde7caec932884434269a91fce0ee8b88659e4a6e1dc45b20bf59864582fe4f5b44cf233194fa509254e1927f0e5add7031

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ebf6.TMP

                                                            Filesize

                                                            371B

                                                            MD5

                                                            0f71138f468294107da32229158ebc2a

                                                            SHA1

                                                            4ce5eab6ccba2902767702fc5a0e194df69a850d

                                                            SHA256

                                                            f0322a715844b7e393f46ed281a85ec2f40f90e390b2455ae218735878dd377e

                                                            SHA512

                                                            2efe560dcde1b59392f2e72eccd5dbc3609128271a7e93e97557886bf1770b287576f8822b0cce177334be1b72fbed6a5987b95e51dd0e4040ecd47c13ba77f5

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                            Filesize

                                                            16B

                                                            MD5

                                                            6752a1d65b201c13b62ea44016eb221f

                                                            SHA1

                                                            58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                                            SHA256

                                                            0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                                            SHA512

                                                            9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            ffd4a80be00ca193587d0458fa56be69

                                                            SHA1

                                                            31686d07c5489bf54a901eaeae74b1c9e1fdb385

                                                            SHA256

                                                            3315dec8dccf38e88cd83567b2aa8cd62ce1ad14a0093312533a9fbf8a1e20e9

                                                            SHA512

                                                            eb4eceaed5ddc136e78f52485fad95a1cfa716ea0ecc6b8f3ef11cf3bc362e3a2fd70d32fce8b905707f726cddaaaf7d18c6d7b9372f56bbb0bcf92f53d3e674

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                            Filesize

                                                            10KB

                                                            MD5

                                                            44e2128bd2b7f0999a5a52e860e28396

                                                            SHA1

                                                            fe545aeb9143d8c6678ca88be01085e8b3937982

                                                            SHA256

                                                            bc8416330ccb61b67065d355beca1e92bdca3bf162517c48115c80e57bd62c38

                                                            SHA512

                                                            6d7006119161365c67229467dfc41b23bd3de25794a382189c0dc60376712d03b2423a5bac19fccfe240de740151ced63c8c7d732e894abc49e1c22d6cb92559

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                            Filesize

                                                            11KB

                                                            MD5

                                                            f0c6e9eb729e124de9b8d658b377270a

                                                            SHA1

                                                            6d27055febe065a54bbae2f02fc3bfc02b5e89d3

                                                            SHA256

                                                            30f891fc0501cc1a85407e4b79351704e57ec157a1242ab68b98c78cb6eda69d

                                                            SHA512

                                                            2b1614575bf7b4039ca9a893003998637fe9b95f7f47fe7989f883e79deb1a43a0239aa6e71b01e170c560ac9e66c6355a4684eb9e78679f3b710117b6492a54

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                            Filesize

                                                            704KB

                                                            MD5

                                                            8244c010d7e91920fdfdb98fa60053a5

                                                            SHA1

                                                            52a4736d33fd465586ca28d457c92477d7d96b9d

                                                            SHA256

                                                            786ca31a957ff389acf25da158c594bcd43606533813439629decbfeac57173e

                                                            SHA512

                                                            dbf126be452945d1514d116f944d5cdecf014045e526a88e62c03288256e668a1120bf3b22b8d2875385f51561ff437a065e0114e9a9c987233572474b96868f

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                            Filesize

                                                            1024KB

                                                            MD5

                                                            1b1fba6c5f21b7b2cf1aff7374f3d532

                                                            SHA1

                                                            5cf3e256c7f768ec4d3899d49f1f95785e27932d

                                                            SHA256

                                                            07b260f26d650d6d07b6bc237bc51553e05d9aee32d9ba4a832244172bc72235

                                                            SHA512

                                                            9f9177eba75a5e31e57118281cd171028caa37fb955cb19b5c082a199ccf74cf3bf8ccabf8754bfac125a72e01e71a0170a57562bba6f94951b5b28928f5d6d8

                                                          • C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

                                                            Filesize

                                                            9KB

                                                            MD5

                                                            7050d5ae8acfbe560fa11073fef8185d

                                                            SHA1

                                                            5bc38e77ff06785fe0aec5a345c4ccd15752560e

                                                            SHA256

                                                            cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

                                                            SHA512

                                                            a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

                                                          • C:\Users\Admin\AppData\Local\Temp\one.rtf

                                                            Filesize

                                                            403B

                                                            MD5

                                                            6fbd6ce25307749d6e0a66ebbc0264e7

                                                            SHA1

                                                            faee71e2eac4c03b96aabecde91336a6510fff60

                                                            SHA256

                                                            e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

                                                            SHA512

                                                            35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

                                                          • C:\Users\Admin\AppData\Local\Temp\rniw.exe

                                                            Filesize

                                                            76KB

                                                            MD5

                                                            9232120b6ff11d48a90069b25aa30abc

                                                            SHA1

                                                            97bb45f4076083fca037eee15d001fd284e53e47

                                                            SHA256

                                                            70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

                                                            SHA512

                                                            b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

                                                          • C:\Users\Admin\AppData\Local\Temp\windl.bat

                                                            Filesize

                                                            771B

                                                            MD5

                                                            a9401e260d9856d1134692759d636e92

                                                            SHA1

                                                            4141d3c60173741e14f36dfe41588bb2716d2867

                                                            SHA256

                                                            b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

                                                            SHA512

                                                            5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

                                                          • C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

                                                            Filesize

                                                            396B

                                                            MD5

                                                            9037ebf0a18a1c17537832bc73739109

                                                            SHA1

                                                            1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

                                                            SHA256

                                                            38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

                                                            SHA512

                                                            4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

                                                          • C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\chilledwindows.mp4

                                                            Filesize

                                                            3.6MB

                                                            MD5

                                                            698ddcaec1edcf1245807627884edf9c

                                                            SHA1

                                                            c7fcbeaa2aadffaf807c096c51fb14c47003ac20

                                                            SHA256

                                                            cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

                                                            SHA512

                                                            a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

                                                          • C:\Users\Admin\Downloads\Unconfirmed 630697.crdownload

                                                            Filesize

                                                            248KB

                                                            MD5

                                                            20d2c71d6d9daf4499ffc4a5d164f1c3

                                                            SHA1

                                                            38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

                                                            SHA256

                                                            3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

                                                            SHA512

                                                            8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

                                                          • memory/3160-1139-0x00000000214A0000-0x00000000214D8000-memory.dmp

                                                            Filesize

                                                            224KB

                                                          • memory/3160-1140-0x0000000021470000-0x000000002147E000-memory.dmp

                                                            Filesize

                                                            56KB

                                                          • memory/3160-1138-0x0000000021410000-0x0000000021418000-memory.dmp

                                                            Filesize

                                                            32KB

                                                          • memory/3160-1125-0x0000000000600000-0x0000000000A64000-memory.dmp

                                                            Filesize

                                                            4.4MB

                                                          • memory/3956-2037-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/3956-1120-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/4444-1197-0x0000000000400000-0x0000000000454000-memory.dmp

                                                            Filesize

                                                            336KB

                                                          • memory/4444-1195-0x0000000000400000-0x0000000000454000-memory.dmp

                                                            Filesize

                                                            336KB

                                                          • memory/5016-2035-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/5016-1119-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/5212-2039-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/5212-1124-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/5540-2036-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/5540-1159-0x0000000000400000-0x00000000004A6000-memory.dmp

                                                            Filesize

                                                            664KB

                                                          • memory/5712-1222-0x0000000008F80000-0x0000000008F90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1218-0x0000000008F80000-0x0000000008F90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1220-0x0000000009060000-0x0000000009070000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1224-0x0000000009060000-0x0000000009070000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1223-0x0000000008F80000-0x0000000008F90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1219-0x0000000008F80000-0x0000000008F90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1221-0x0000000009060000-0x0000000009070000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1217-0x0000000008F80000-0x0000000008F90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1216-0x0000000008F80000-0x0000000008F90000-memory.dmp

                                                            Filesize

                                                            64KB

                                                          • memory/5712-1210-0x0000000008F00000-0x0000000008F0E000-memory.dmp

                                                            Filesize

                                                            56KB

                                                          • memory/5712-1209-0x0000000008F30000-0x0000000008F68000-memory.dmp

                                                            Filesize

                                                            224KB

                                                          • memory/5712-1201-0x00000000057E0000-0x0000000005D84000-memory.dmp

                                                            Filesize

                                                            5.6MB

                                                          • memory/5712-1200-0x0000000000050000-0x00000000006FE000-memory.dmp

                                                            Filesize

                                                            6.7MB

                                                          • memory/6036-2041-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                            Filesize

                                                            656KB

                                                          • memory/6036-1199-0x0000000000400000-0x00000000004A4000-memory.dmp

                                                            Filesize

                                                            656KB