hxxps://www[.]google[.]com/?safe=active&ssui=on

Resubmissions

07/01/2025, 22:05

250107-1z1rms1kat 3

04/09/2024, 21:58

04/09/2024, 21:55

04/09/2024, 21:38

04/09/2024, 21:22

Analysis

max time kernel
231s
max time network
238s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/09/2024, 21:58

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://www.google.com/?safe=active&ssui=on

Score

8^/10

aspackv2 discovery evasion ransomware upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0004000000021f22-916.dat	aspack_v212_v242

Executes dropped EXE 3 IoCs

pid	Process
5016	Avoid.exe
3956	Avoid.exe
5212	Avoid.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/4444-1195-0x0000000000400000-0x0000000000454000-memory.dmp	upx
behavioral1/memory/4444-1197-0x0000000000400000-0x0000000000454000-memory.dmp	upx

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\K:	000.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\P:	000.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
131	raw.githubusercontent.com
132	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\Desktop\Wallpaper	000.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ArcticBomb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Alerta.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Flasher.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Avoid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5400	taskkill.exe
3924	taskkill.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{8D2E720A-0939-4AC5-8236-1475318B269B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{4FBE53F6-71C5-41DC-B966-8251CFB88224}	ChilledWindows.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1194130065-3471212556-1656947724-1000\{24502DC2-4672-4692-9903-86FFEED42BAF}	000.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 630697.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
1468	msedge.exe
1468	msedge.exe
4236	identity_helper.exe
4236	identity_helper.exe
4148	msedge.exe
4148	msedge.exe
3240	msedge.exe
3240	msedge.exe
3632	msedge.exe
3632	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe
1652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3160	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3160	ChilledWindows.exe
Token: 33	1892	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1892	AUDIODG.EXE
Token: SeShutdownPrivilege	3160	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3160	ChilledWindows.exe
Token: SeShutdownPrivilege	3160	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	3160	ChilledWindows.exe
Token: SeDebugPrivilege	5400	taskkill.exe
Token: SeShutdownPrivilege	5712	000.exe
Token: SeCreatePagefilePrivilege	5712	000.exe
Token: SeDebugPrivilege	3924	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5440	WMIC.exe
Token: SeSecurityPrivilege	5440	WMIC.exe
Token: SeTakeOwnershipPrivilege	5440	WMIC.exe
Token: SeLoadDriverPrivilege	5440	WMIC.exe
Token: SeSystemProfilePrivilege	5440	WMIC.exe
Token: SeSystemtimePrivilege	5440	WMIC.exe
Token: SeProfSingleProcessPrivilege	5440	WMIC.exe
Token: SeIncBasePriorityPrivilege	5440	WMIC.exe
Token: SeCreatePagefilePrivilege	5440	WMIC.exe
Token: SeBackupPrivilege	5440	WMIC.exe
Token: SeRestorePrivilege	5440	WMIC.exe
Token: SeShutdownPrivilege	5440	WMIC.exe
Token: SeDebugPrivilege	5440	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5440	WMIC.exe
Token: SeRemoteShutdownPrivilege	5440	WMIC.exe
Token: SeUndockPrivilege	5440	WMIC.exe
Token: SeManageVolumePrivilege	5440	WMIC.exe
Token: 33	5440	WMIC.exe
Token: 34	5440	WMIC.exe
Token: 35	5440	WMIC.exe
Token: 36	5440	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5440	WMIC.exe
Token: SeSecurityPrivilege	5440	WMIC.exe
Token: SeTakeOwnershipPrivilege	5440	WMIC.exe
Token: SeLoadDriverPrivilege	5440	WMIC.exe
Token: SeSystemProfilePrivilege	5440	WMIC.exe
Token: SeSystemtimePrivilege	5440	WMIC.exe
Token: SeProfSingleProcessPrivilege	5440	WMIC.exe
Token: SeIncBasePriorityPrivilege	5440	WMIC.exe
Token: SeCreatePagefilePrivilege	5440	WMIC.exe
Token: SeBackupPrivilege	5440	WMIC.exe
Token: SeRestorePrivilege	5440	WMIC.exe
Token: SeShutdownPrivilege	5440	WMIC.exe
Token: SeDebugPrivilege	5440	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5440	WMIC.exe
Token: SeRemoteShutdownPrivilege	5440	WMIC.exe
Token: SeUndockPrivilege	5440	WMIC.exe
Token: SeManageVolumePrivilege	5440	WMIC.exe
Token: 33	5440	WMIC.exe
Token: 34	5440	WMIC.exe
Token: 35	5440	WMIC.exe
Token: 36	5440	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4796	WMIC.exe
Token: SeSecurityPrivilege	4796	WMIC.exe
Token: SeTakeOwnershipPrivilege	4796	WMIC.exe
Token: SeLoadDriverPrivilege	4796	WMIC.exe
Token: SeSystemProfilePrivilege	4796	WMIC.exe
Token: SeSystemtimePrivilege	4796	WMIC.exe
Token: SeProfSingleProcessPrivilege	4796	WMIC.exe
Token: SeIncBasePriorityPrivilege	4796	WMIC.exe
Token: SeCreatePagefilePrivilege	4796	WMIC.exe
Token: SeBackupPrivilege	4796	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe
1468	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5712	000.exe
5712	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 3064	1468	msedge.exe	83
PID 1468 wrote to memory of 3064	1468	msedge.exe	83
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 2556	1468	msedge.exe	84
PID 1468 wrote to memory of 224	1468	msedge.exe	85
PID 1468 wrote to memory of 224	1468	msedge.exe	85
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86
PID 1468 wrote to memory of 2940	1468	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/?safe=active&ssui=on
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ef2a46f8,0x7ff8ef2a4708,0x7ff8ef2a4718
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2036 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2104 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:6036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9244852073377358323,14725365099134087796,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3796 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1652
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5016
- C:\Users\Admin\Downloads\Avoid.exe
  "C:\Users\Admin\Downloads\Avoid.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1668

C:\Users\Admin\Downloads\Avoid.exe
"C:\Users\Admin\Downloads\Avoid.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5212

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:5540

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3160

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x50c 0x33c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1892

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Flasher.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Flasher.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:6036

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ArcticBomb.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ArcticBomb.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4444

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:2592

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\000.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\000.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2528
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5400
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3924
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5440
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4796
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:3920

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa397c855 /state1:0x41c64e6d
1⤵
PID:4832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
64KB

MD5
d6b36c7d4b06f140f860ddc91a4c659c

SHA1
ccf16571637b8d3e4c9423688c5bd06167bfb9e9

SHA256
34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92

SHA512
2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
41KB

MD5
9101760b0ce60082c6a23685b9752676

SHA1
0aa9ef19527562f1f7de1a8918559b6e83208245

SHA256
71e4b25e3f86e9e98d4e5ce316842dbf00f7950aad67050b85934b6b5fdfcca5

SHA512
cfa1dc3af7636d49401102181c910536e7e381975592db25ab8b3232bc2f98a4e530bb7457d05cbff449682072ed74a8b65c196d31acb59b9904031025da4af4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
70KB

MD5
4058c842c36317dcd384b6c2deaa8b95

SHA1
1085ddb12b29b79ffe51937ba9cd1957e5e229b4

SHA256
0e562969cad63d217848a5080273d1745dc4277d210b68a769c822f2fbfd75f6

SHA512
435a67024811360b12339e3916945b0639e2d9319e9d540b73e093848a467b030e91e01917b7fb804eb756dabce2fe53c2d7ea586554ee6cfee70e652a85924a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
19KB

MD5
76a3f1e9a452564e0f8dce6c0ee111e8

SHA1
11c3d925cbc1a52d53584fd8606f8f713aa59114

SHA256
381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c

SHA512
a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
65KB

MD5
56d57bc655526551f217536f19195495

SHA1
28b430886d1220855a805d78dc5d6414aeee6995

SHA256
f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4

SHA512
7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
84KB

MD5
74e33b4b54f4d1f3da06ab47c5936a13

SHA1
6e5976d593b6ee3dca3c4dbbb90071b76e1cd85c

SHA256
535fc48679c38decd459ad656bdd6914e539754265244d0cc7b1da6bddf3e287

SHA512
79218e8ee50484af968480ff9b211815c97c3f3035414e685aa5d15d9b4152682d87b66202339f212bf3b463a074bf7a4431107b50303f28e2eb4b17843991c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
1.2MB

MD5
7026721097c2f006156832039de8e081

SHA1
d5e4492b4c91315efdb439bdd37c51b3686012d7

SHA256
e8b9d92852b1e7f7c9d65a15a0eda913e1de63d1b6db3acc27b948768fdd1a36

SHA512
01924a654375a1e592ac6a952917b50e6187ceec41101cb2068b8618d8e582b8c0658ed7459afe13d557e7e5252606d1cdc595fffcdcda1537037b254801c538

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
43KB

MD5
209af4da7e0c3b2a6471a968ba1fc992

SHA1
2240c2da3eba4f30b0c3ef2205ce7848ecff9e3f

SHA256
ecc145203f1c562cae7b733a807e9333c51d75726905a3af898154f3cefc9403

SHA512
09201e377e80a3d03616ff394d836c85712f39b65a3138924d62a1f3ede3eac192f1345761c012b0045393c501d48b5a774aeda7ab5d687e1d7971440dc1fc35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
73KB

MD5
cf604c923aae437f0acb62820b25d0fd

SHA1
84db753fe8494a397246ccd18b3bb47a6830bc98

SHA256
e2b4325bb9a706cbfba8f39cca5bde9dae935cbb1d6c8a562c62e740f2208ab4

SHA512
754219b05f2d81d11f0b54e5c7dd687bd82aa59a357a3074bca60fefd3a88102577db8ae60a11eb25cc9538af1da39d25fa6f38997bdc8184924d0c5920e89c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
27KB

MD5
ac4c4890fa7b92d5f076e94b226f42af

SHA1
15af973f75d3440b01f9b849d8a2ab7de4dd7bc4

SHA256
a2f3c4f186f667d67c725d82bf27ccdcb0f760447fb3ec2abed61f2107105051

SHA512
cd38b78aab26318c948e583ed3db13c21c76c9d83141f3ce5c45a3c74733e6e9e1329ca5afd4fd8910bc9f9536143ef491e74c04e10a5a38734d4c56d26e5c9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016

Filesize
18KB

MD5
5c73e3854f194383c96b8aa03078f1af

SHA1
42a2f5e77043eb2cec42a9b5067968396bc63372

SHA256
756ccfdfde5584770db79aa215a1442f1a472fe299b337d6b04e5fc84a02c2ca

SHA512
6bc904ea793bbc13a7bea5e8a4891926fbb4f8854d213ec2650effdbdbbb3e33b1ae66fbfbcc7a21c82dd4b2e6927f45c0df984a5e13a1aaf4259cc8608ec02f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
fb851374aaab43caa835dfc75c4c56ad

SHA1
9a7115d8f706a405b2e3ec9438fab1750d51cd5d

SHA256
2b27ebd9c48ef02ab138a3784428f7640bd03e89e1b0db871d42fca98efeb3de

SHA512
f384fb52e2a8d4627447a670cacfe57a09d5888a03537b40a1f2e6199e61e9bd04fb2608816c1992cbaad439159e197e9c7f252b60d47dfdc6f27ed335794295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
cdafbe2f00ff505aec87050a5c6714dd

SHA1
425b6fcb8db2cfaf1f7ed934ac7ea78903676cd6

SHA256
777da4cb574cec65ff624d6d2f8880ae42ee4d315ad495711fdacdce9fa023bb

SHA512
a5e4d97b55abaf2df71a59de4adfc0b442c2f6cec6fd51b62963657f481cc9f0c0881a85c7b916e8e82117e6d1d35f1f6991b0284aba712d55d11ad50dcae424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1850e494209916e214cf7521f9ac5057

SHA1
7cf209c9fc439cea4ba0afd7af5a4d5e20d25e86

SHA256
4c91b08a1561792f36c53ef3689e4b356dfa6b8cd3060828f8059f6aeaa26f63

SHA512
49c9252f0ec0ea76c58dd5edf37a3ff26739bc900132991da970739775d010cb154c222e01e645108a139a87153e0628fd3f922fb1ae7b93b9ecfbd49620f919

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0ca0e92cf868d8d5f16771bcee3bc6b8

SHA1
d615ebdac6583c7bc4730085056b3384124d53a4

SHA256
eee6a1ead834b7a2c41a4dbb0acf4121f3c69877919c07357e92f56e3cdf5b11

SHA512
1a7e255ec19722f8db4c415974fcb6e65b5332e86a65529f6d6ee184d266f32d2c4e4a6d5f7d651dca6714695f11414d54ad5ec8febb542bf75d634991eff23d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
eb288c0de011ebee379ae68b3ca0f84b

SHA1
d25d27d34741283b5964ab1a1c0ea195bd756c7c

SHA256
4fe9af31370e3db32bedc90fb80f345bc672df2f1197a2091009ee73f0efcee5

SHA512
be27583cf0a68e8068505a5e91b525a6918e7d573246a452374b2c0fc338c85e82533f9c5f64db6b9fac0128a1850636c061a8b364e50598b610444041806662

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c0b78b0fd1218abf886c76054c1a51b

SHA1
03114f201ba1a31a451c3ff18df3db8d3dc5fa5b

SHA256
6fc3271f368a8f8b95633100ddb877bf2600e07e9b77bbca0832e539d72982af

SHA512
46059a61657bc7e41c961b872c45c17150d02dfb4de6ced661a8cb3177eb1f802b51cbf5e8421d48629806eb40a2879e0aa8515bded15292012105787e648a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8513fb4f4dba6d153157e4b76a87bbf2

SHA1
a0cc4ca0009f9cd9fb0c261fa426c9908418d0bb

SHA256
bc186042f24a856cb493468aefdac883688b468649cca7d99614cc210fe4ff8c

SHA512
647de139e1c6df145f72afda5a3bf3c42a2af1282e7e94e4f08ff644931b598a0f59026c171ee01e7f36b7948c433cd57e10b33659581247d32c60a4bf4991c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
981e4c183e2296c40a3a7a064dea093e

SHA1
ebf8230761dcd2e9bb110fe29ddbc47d4000df5d

SHA256
c1a3266caea2c47b1458b62cd5da2d27554a83c1575384282eba4f73c30dedcc

SHA512
a06398d738c5b5ff164fc9a63d8d78717ef3bfb4272e65e8ea21d9dc303fb97123adc9ced2d7a1a51e405e994e3908277b728674237816fa0a111b3b162347e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bbf17641483b429a73a10423e8798868

SHA1
6d27d139240f19a0ac09181959ba60b9a589a2da

SHA256
f64709d47d5869dd816a4a696ecd0e6921e94bcca1c1db9519a7394788737b2d

SHA512
d356462e2e335153d7b99ce7f6c96f9bc74f5b324489243d5bbe26cf1116ca17e0b17ea8ca18ac4ee6e769a81e65c411c80e02e7565188542abe5c05ad4b9496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
96df6e5e8e885b9f5f2cd1d665a8189c

SHA1
81c2b1cdfac5ef26d468fa11837f185e9d2adf4c

SHA256
46a6d6c06de8601c4aca75b81ca040d23c6d06eecdf8957c35506863a00f8f57

SHA512
2223650ddf3daa63a884843b3a6ff62bfa591f617f0f9478945fa3d99b8ef29a43c27dcd79df7ac37acb6b7c86f08c01a5a4de0117f737441d7a06c4339af14a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7f8ad7802579b7b224c05521843eb430

SHA1
ee0f5181345de6452566f2354e36750985294e58

SHA256
8482c9d6c49f3e2a08761cdaa49dc71ba91b6576317b595cf38145f20a9f0ce3

SHA512
da590f7f7de29b9a10a7569965d6b77d992bbead05ed745b9d72d093d3d531f1019689166046083c39d3d48737eabb2f78e6fe115d49219ff23b594f1b4e02c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
41481645bd503ff0e04d2c46cb06724b

SHA1
fd5fa96be163d8deb05dc1ff6d6303b8f6aa5eb3

SHA256
d7508b75270b3952bfbf9fd6864a79aa6b01784f84e8fc2302458a4ed1d8a6f4

SHA512
cef0c386c65fb3b705d4e178737daee8840dacfcff2700778d1a4295ecb03cf3a419ddae27c7b1332c434769b87cf12c33f908ffffe2201cbee00ae5c370ca6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
21e6a6d12680e64f3dd527b7e2b7991d

SHA1
72bcb90cdf8e5ee430543e58600cbd702e700896

SHA256
a282766de682a1536354ab65d5bbad2ef6e5cd984a18f87868774622dfa62fda

SHA512
7098be494ccad3ebbd1e8b8639200621567f477cacd9cccd89152cd2d859e4548fb6c099b44a1ca398012a8fb814a90eef6341acabd61f445371fb6d69c6b594

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
939466f6fb7109856c3791c0909e0f5a

SHA1
a998ac19a1a5ef770cd0a08565ea2e872eecf7a0

SHA256
93079309d75f364a877ac0a140bba7fda43286ffa33780cb98a03dd1faecfa28

SHA512
b524459701f2ba8ee8917ce85cebf17988653d8591200e5ecb7756cf2e81b1b4bdb450a731ef935029fcb9ca7856670f8a4e7b5d7d597e16b57695a4dd9c9ffc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
98b61e2087be212acdecf8a5dd031c53

SHA1
8e6b47537c3b83e09f83654ac7e9b8d3f29d8d4d

SHA256
20107394c96cc8a72ab5a06a504002a61700fb0e5d4a818fdf3eb97eceb37177

SHA512
c797584039b2a3b32f05d363b4e24e2687baacce1dcdc0e2a70b25377964f4c7ad735fd4600d26d94fee5c58db25f04e03a677ac27b0cbde466ef5345b0b312c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
eea32ad9b956a1c07b682d7cd5f174e1

SHA1
3ba034f069419ba721598b8b41a5dee22d3cd9e5

SHA256
470d1acee8855fa70144a84b1e6cb4840c3f826b0b11855c4c8a8e5ad602191c

SHA512
ef363f0b586c4097d3c24a3db02dcddd514488947fb423e400e5e799d5b6c50a8662d50aa0cb281d17e904e23ec52318fcfd73ad00aac5ed65b7fb0a68736dfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
62384e4379375c01ea40878df14d9a5a

SHA1
19eb9a77e3c1bc757d4b0e572ff584f062818906

SHA256
fe70aa2bcd43e47972e42e11f17bd180f70e29e439f14a338d0c55d144fc6a45

SHA512
509740fbc4e1597c692e8e85c3fbf7e9f82a249243abb0b4077344879c4088877714881eb00868687d8701d4837cae3c4fd186f4238a953fdbedead7a4fa066d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d7111e47b64cf87456127313e52ca1a6

SHA1
e8acf833c7c394bbcb03b623c30d290b78d5ad03

SHA256
cdef1bc8711a43711e6ca87c6a3cebdf66848b792d735bfd8a8138be801fef72

SHA512
d71a62ab0ac42de1700b86a7dae09cde7caec932884434269a91fce0ee8b88659e4a6e1dc45b20bf59864582fe4f5b44cf233194fa509254e1927f0e5add7031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ebf6.TMP

Filesize
371B

MD5
0f71138f468294107da32229158ebc2a

SHA1
4ce5eab6ccba2902767702fc5a0e194df69a850d

SHA256
f0322a715844b7e393f46ed281a85ec2f40f90e390b2455ae218735878dd377e

SHA512
2efe560dcde1b59392f2e72eccd5dbc3609128271a7e93e97557886bf1770b287576f8822b0cce177334be1b72fbed6a5987b95e51dd0e4040ecd47c13ba77f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ffd4a80be00ca193587d0458fa56be69

SHA1
31686d07c5489bf54a901eaeae74b1c9e1fdb385

SHA256
3315dec8dccf38e88cd83567b2aa8cd62ce1ad14a0093312533a9fbf8a1e20e9

SHA512
eb4eceaed5ddc136e78f52485fad95a1cfa716ea0ecc6b8f3ef11cf3bc362e3a2fd70d32fce8b905707f726cddaaaf7d18c6d7b9372f56bbb0bcf92f53d3e674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44e2128bd2b7f0999a5a52e860e28396

SHA1
fe545aeb9143d8c6678ca88be01085e8b3937982

SHA256
bc8416330ccb61b67065d355beca1e92bdca3bf162517c48115c80e57bd62c38

SHA512
6d7006119161365c67229467dfc41b23bd3de25794a382189c0dc60376712d03b2423a5bac19fccfe240de740151ced63c8c7d732e894abc49e1c22d6cb92559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f0c6e9eb729e124de9b8d658b377270a

SHA1
6d27055febe065a54bbae2f02fc3bfc02b5e89d3

SHA256
30f891fc0501cc1a85407e4b79351704e57ec157a1242ab68b98c78cb6eda69d

SHA512
2b1614575bf7b4039ca9a893003998637fe9b95f7f47fe7989f883e79deb1a43a0239aa6e71b01e170c560ac9e66c6355a4684eb9e78679f3b710117b6492a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
704KB

MD5
8244c010d7e91920fdfdb98fa60053a5

SHA1
52a4736d33fd465586ca28d457c92477d7d96b9d

SHA256
786ca31a957ff389acf25da158c594bcd43606533813439629decbfeac57173e

SHA512
dbf126be452945d1514d116f944d5cdecf014045e526a88e62c03288256e668a1120bf3b22b8d2875385f51561ff437a065e0114e9a9c987233572474b96868f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
1024KB

MD5
1b1fba6c5f21b7b2cf1aff7374f3d532

SHA1
5cf3e256c7f768ec4d3899d49f1f95785e27932d

SHA256
07b260f26d650d6d07b6bc237bc51553e05d9aee32d9ba4a832244172bc72235

SHA512
9f9177eba75a5e31e57118281cd171028caa37fb955cb19b5c082a199ccf74cf3bf8ccabf8754bfac125a72e01e71a0170a57562bba6f94951b5b28928f5d6d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\Desktop\UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR NEXT UR N1XT.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 630697.crdownload

Filesize
248KB

MD5
20d2c71d6d9daf4499ffc4a5d164f1c3

SHA1
38e5dcd93f25386d05a34a5b26d3fba1bf02f7c8

SHA256
3ac8cc58dcbceaec3dab046aea050357e0e2248d30b0804c738c9a5b037c220d

SHA512
8ffd56fb3538eb60da2dde9e3d6eee0dac8419c61532e9127f47c4351b6e53e01143af92b2e26b521e23cdbbf15d7a358d3757431e572e37a1eede57c7d39704

Download Submit
memory/3160-1139-0x00000000214A0000-0x00000000214D8000-memory.dmp

Filesize
224KB

Download
memory/3160-1140-0x0000000021470000-0x000000002147E000-memory.dmp

Filesize
56KB

Download
memory/3160-1138-0x0000000021410000-0x0000000021418000-memory.dmp

Filesize
32KB

Download
memory/3160-1125-0x0000000000600000-0x0000000000A64000-memory.dmp

Filesize
4.4MB

Download
memory/3956-2037-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/3956-1120-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/4444-1197-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/4444-1195-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/5016-2035-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5016-1119-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5212-2039-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5212-1124-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5540-2036-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5540-1159-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/5712-1222-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/5712-1218-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/5712-1220-0x0000000009060000-0x0000000009070000-memory.dmp

Filesize
64KB

Download
memory/5712-1224-0x0000000009060000-0x0000000009070000-memory.dmp

Filesize
64KB

Download
memory/5712-1223-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/5712-1219-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/5712-1221-0x0000000009060000-0x0000000009070000-memory.dmp

Filesize
64KB

Download
memory/5712-1217-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/5712-1216-0x0000000008F80000-0x0000000008F90000-memory.dmp

Filesize
64KB

Download
memory/5712-1210-0x0000000008F00000-0x0000000008F0E000-memory.dmp

Filesize
56KB

Download
memory/5712-1209-0x0000000008F30000-0x0000000008F68000-memory.dmp

Filesize
224KB

Download
memory/5712-1201-0x00000000057E0000-0x0000000005D84000-memory.dmp

Filesize
5.6MB

Download
memory/5712-1200-0x0000000000050000-0x00000000006FE000-memory.dmp

Filesize
6.7MB

Download
memory/6036-2041-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download
memory/6036-1199-0x0000000000400000-0x00000000004A4000-memory.dmp

Filesize
656KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads