hxxps://github[.]com/pankoza2-pl/malwaredatabase-old

Analysis

max time kernel
120s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/malwaredatabase-old

Score

8^/10

bootkit discovery evasion exploit persistence

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file

Possible privilege escalation attempt 9 IoCs

exploit

pid	Process
2176	icacls.exe
2224	icacls.exe
1464	icacls.exe
1400	takeown.exe
644	icacls.exe
5100	icacls.exe
1580	takeown.exe
3584	icacls.exe
2312	takeown.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	Win8.Horror.Destructive 1.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
3112	Win8.Horror.Destructive 1.0.exe
4588	TrashMBR.exe
4808	HorrorGui.exe

Modifies file permissions 1 TTPs 9 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2312	takeown.exe
1464	icacls.exe
644	icacls.exe
1400	takeown.exe
5100	icacls.exe
2176	icacls.exe
3584	icacls.exe
2224	icacls.exe
1580	takeown.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\A:	WScript.exe
File opened (read-only)	\??\B:	WScript.exe
File opened (read-only)	\??\Q:	WScript.exe
File opened (read-only)	\??\V:	WScript.exe
File opened (read-only)	\??\W:	WScript.exe
File opened (read-only)	\??\E:	WScript.exe
File opened (read-only)	\??\I:	WScript.exe
File opened (read-only)	\??\P:	WScript.exe
File opened (read-only)	\??\R:	WScript.exe
File opened (read-only)	\??\S:	WScript.exe
File opened (read-only)	\??\U:	WScript.exe
File opened (read-only)	\??\Y:	WScript.exe
File opened (read-only)	\??\Z:	WScript.exe
File opened (read-only)	\??\G:	WScript.exe
File opened (read-only)	\??\K:	WScript.exe
File opened (read-only)	\??\L:	WScript.exe
File opened (read-only)	\??\N:	WScript.exe
File opened (read-only)	\??\O:	WScript.exe
File opened (read-only)	\??\T:	WScript.exe
File opened (read-only)	\??\X:	WScript.exe
File opened (read-only)	\??\H:	WScript.exe
File opened (read-only)	\??\J:	WScript.exe
File opened (read-only)	\??\M:	WScript.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
70	raw.githubusercontent.com
71	raw.githubusercontent.com

Modifies boot configuration data using bcdedit 1 IoCs

pid	Process
1592	bcdedit.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	TrashMBR.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TrashMBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HorrorGui.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Win8.Horror.Destructive 1.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 22 IoCs

evasion

pid	Process
640	taskkill.exe
2256	taskkill.exe
4916	taskkill.exe
5036	taskkill.exe
4840	taskkill.exe
2620	taskkill.exe
4356	taskkill.exe
348	taskkill.exe
1064	taskkill.exe
4560	taskkill.exe
1236	taskkill.exe
4952	taskkill.exe
428	taskkill.exe
4184	taskkill.exe
4284	taskkill.exe
3724	taskkill.exe
2700	taskkill.exe
4916	taskkill.exe
4444	taskkill.exe
3048	taskkill.exe
2744	taskkill.exe
4248	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000_Classes\Local Settings	cmd.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
3696	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 60212.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3160	msedge.exe
3160	msedge.exe
1692	msedge.exe
1692	msedge.exe
5116	identity_helper.exe
5116	identity_helper.exe
2236	msedge.exe
2236	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of AdjustPrivilegeToken 31 IoCs

description	pid	Process
Token: SeDebugPrivilege	348	taskkill.exe
Token: SeTakeOwnershipPrivilege	1580	takeown.exe
Token: SeDebugPrivilege	2256	taskkill.exe
Token: SeTakeOwnershipPrivilege	2312	takeown.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeTakeOwnershipPrivilege	1400	takeown.exe
Token: SeShutdownPrivilege	2136	WScript.exe
Token: SeCreatePagefilePrivilege	2136	WScript.exe
Token: 33	3920	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3920	AUDIODG.EXE
Token: SeShutdownPrivilege	2136	WScript.exe
Token: SeCreatePagefilePrivilege	2136	WScript.exe
Token: SeDebugPrivilege	1064	taskkill.exe
Token: SeDebugPrivilege	4560	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe
Token: SeDebugPrivilege	5036	taskkill.exe
Token: SeDebugPrivilege	3048	taskkill.exe
Token: SeDebugPrivilege	1236	taskkill.exe
Token: SeDebugPrivilege	4184	taskkill.exe
Token: SeDebugPrivilege	4952	taskkill.exe
Token: SeDebugPrivilege	4840	taskkill.exe
Token: SeDebugPrivilege	2744	taskkill.exe
Token: SeDebugPrivilege	4284	taskkill.exe
Token: SeDebugPrivilege	2620	taskkill.exe
Token: SeDebugPrivilege	4356	taskkill.exe
Token: SeDebugPrivilege	640	taskkill.exe
Token: SeDebugPrivilege	4248	taskkill.exe
Token: SeDebugPrivilege	3724	taskkill.exe
Token: SeDebugPrivilege	428	taskkill.exe
Token: SeDebugPrivilege	2700	taskkill.exe
Token: SeDebugPrivilege	4916	taskkill.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3112	Win8.Horror.Destructive 1.0.exe
4808	HorrorGui.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3204	1692	msedge.exe	84
PID 1692 wrote to memory of 3204	1692	msedge.exe	84
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 2380	1692	msedge.exe	85
PID 1692 wrote to memory of 3160	1692	msedge.exe	86
PID 1692 wrote to memory of 3160	1692	msedge.exe	86
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87
PID 1692 wrote to memory of 2424	1692	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/pankoza2-pl/malwaredatabase-old
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0a8746f8,0x7ffc0a874708,0x7ffc0a874718
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Users\Admin\Downloads\Win8.Horror.Destructive 1.0.exe
  "C:\Users\Admin\Downloads\Win8.Horror.Destructive 1.0.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3112
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\438C.tmp\438D.tmp\438E.vbs //Nologo
    3⤵
    - Checks computer location settings
    PID:4604
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\438C.tmp\Horror8.bat" "
      4⤵
      Checks computer location settings
      Modifies registry class
      PID:1156
    - - C:\Windows\system32\reg.exe
        
        reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:3696
    - - C:\Windows\system32\bcdedit.exe
        
        bcdedit /delete {current}
        5⤵
        Modifies boot configuration data using bcdedit
        
        PID:1592
    - - C:\Users\Admin\AppData\Local\Temp\438C.tmp\TrashMBR.exe
        
        TrashMBR.exe
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:4588
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im taskmgr.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:348
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\system32\taskmgr.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1580
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\system32\taskmgr.exe /grant Admin:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:3584
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\system32\taskmgr.exe /grant "everyone":F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2224
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im logonui.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2256
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\system32\logonui.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:2312
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\system32\logonui.exe /grant Admin:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:1464
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\system32\logonui.exe /grant "everyone":F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:644
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4444
    - - C:\Windows\system32\takeown.exe
        
        takeown /f C:\Windows\explorer.exe
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        Suspicious use of AdjustPrivilegeToken
        
        PID:1400
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\explorer.exe /grant Admin:F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:5100
    - - C:\Windows\system32\icacls.exe
        
        icacls C:\Windows\explorer.exe /grant "everyone":F
        5⤵
        Possible privilege escalation attempt
        Modifies file permissions
        
        PID:2176
    - - C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\438C.tmp\music.vbs"
        5⤵
        Enumerates connected drives
        Suspicious use of AdjustPrivilegeToken
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\438C.tmp\HorrorGui.exe
        
        HorrorGui.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4808
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1064
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4560
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5036
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3048
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:1236
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4184
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4952
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4840
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2744
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4284
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2620
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4356
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:640
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4248
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3724
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:428
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2700
      - C:\Windows\SysWOW64\taskkill.exe
        
        taskkill /f /im wininit.exe
        6⤵
        System Location Discovery: System Language Discovery
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,6200551882998235220,5271982580265869737,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5024 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x500 0x2f4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0004dfc2e14dd6138e9d1a1af29c069c

SHA1
1f147794355213dfbf5c08df616be334101851c9

SHA256
d443de4d8324d2e82ef290e571bdae13ad1bce9b4235874ebce4e3125a28c6b2

SHA512
771d58d22738bce6d0b93ad789b20fa8b015bc806dddad6bb1fff2cfb79766e3f323392480335754db69e9b695b14644381c0bc0b2cf3095f69a0fe5a46587d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
63d94e9846e570803ecf07d6d8f086f5

SHA1
d2c6997f90bf62df74867b6c83a2dff8e6bf7a55

SHA256
b848a82f7fbf217a442db0b47389db16d9040325b5f031d3a0722115a3e5f9d4

SHA512
12b7036056049698bcf8b9979dc48dff770c45b6f57747d50920ded43e4f08f02add7c099a4ab2a5f1b3edb6653d0f5843cb45e845c7c916312acb3fa83149c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
b8fdc8d04b83beb089126efbce00f896

SHA1
971ff6e70884b2cdf229be5a0cad066e3bdb085b

SHA256
c3084bc354488bb98cea934da0e3d6a462b574774df7f3b4fe289688acf3ebfe

SHA512
f5f0033e6bc47a723773fb221dbb2d5b684209ffc7a8046e708df1f5cade52b05158d2fc09fdb3867ca1922734f64fc5cb3bb7224da24df348085092385a45fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77c00fa6740e3b28df077c2a0ab1fad3

SHA1
4a83d53d20f1321eaf31a59fbfb0f2acf3ecc4fc

SHA256
8328b05ed4f29480a54c09efe8174dacafd4542682b2e4efcbcc32edcf5e32ff

SHA512
9de7e37c159d729f3c8db4f74de885f3534f3a990f8f22e022ee3ff1d280c97d644e27d65c047375bde2b38c3c4837fd9da20188344cb759ef3ce30ade796ab5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a22ed3b1f345d9b03d3d74c71825905d

SHA1
6182cd035e244a0238e13f6367b7f534856b7a7d

SHA256
01847a9ec3cbd0dd1044be67db2302676a442f6a8872d833f5d0ab17a3d1cc9a

SHA512
84943580d63bbe4cb81d74ba902d8b52f494a09fb488ad50dba6ffca7040052c893ecb2f5782a480f6d5e320c3dfc74e9c45e11891fc26d17bd9727a2af9045e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cb66de64ac9b603f2a464dcf318fead

SHA1
ca25e488f5b3592f12b7e5003843c08940a9afc2

SHA256
7bc0adc466136c03fbd9c341a92940339f4883feab811b7d852429b3add03536

SHA512
1257320011c59be4e766c2a318032047822c3eae2e9f3b3afc24eb33f01c6b82693b057d375933035e31624012dda109e1276b291b3fe04bf7f712e0660f48a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ba2554452cd898e15235ea600577f90

SHA1
82974040b04e3cb34d6a2bc480657bc0e7d79088

SHA256
8c7a9f5bf836b768e104fba6ed34f80f6702adf9adf2505320faf04dd19c1a1f

SHA512
812b0e1efe78aa93de45c63304f685e50b298f819b95994bff0563e642d8f3ed0a9b4d6eabd8139dd9b1904f7daa86f2ed19255a4d688a576b83706fcbfb141c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3b387466e157315db8e665a9a03417af

SHA1
32ff587946f4376599289f2558dacf78eb6c2a06

SHA256
8b00f139a63a060030c192b67c0fbf934efb13efb618742f33a36b477aa88f7a

SHA512
211718a1bba3edc66fa39afe65153e7fa3ba706e964c80d5cd5c7038df7a366bb126f99661dc10e797f03cb2ac28d9b919976a2d76837ecde295e5d867f3bdf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
803bab4a9b5f6aeee90f7b2cd7fcd703

SHA1
34621885b73bf45144fcbeefcc2eb40ef6a5832a

SHA256
82eecaaaee373b018a67d059881abe08c7534f9088a6b107c52861ee082ce24a

SHA512
55da4f30b766638e46e79d7fd3a7f3458ec07f6795ae0687432e4d9cb9cdbbcd545cd721d5c7495863d13f68ade989d69ec1e0c88c5817f04057917d052aaaa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
8e12d30082b5901b9d9d7a1fcc1f4722

SHA1
e4cdf8ce8fdc8ca9355e8084045ea7bc1420bca5

SHA256
6fbf224bbd8629cd1dd645af3945bb1bfe5ccff83aee3a690bdfcc073cbd15ed

SHA512
275a9540310f56009e4db878c36b0e49369535a8958e0a4bdeade8d8515799d38e520f8eb6f5031c2a678a91dc554464ebf324066a351f80120857f59aa9e8c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
90a622431f575345897cf77817a995b1

SHA1
27f0b4c4a808109f5947a10d0c44eaaf00882757

SHA256
83af7d1e3aa2d93d1befe2811a960d782aecf3700e610f4ac2f64d5ff8cb6822

SHA512
145d165e75c411b77ede0d3cf9685b50bf1001cd894e0c3b0d0574c1b9b439c65dd5d7a5338a7cbc987e9c075a8ee9dff7c6d0f15c4ad431e683adf39eeb6c99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c6bb.TMP

Filesize
539B

MD5
71a8c8a76bd13dae79ab6ea2162b7c80

SHA1
50700d645ce8336b99f5aaf640080cd53251a429

SHA256
e0de0c81e8f2351ad20fa48783f8242d54004e456f2e8cff31f4dae07a9576c2

SHA512
0bf69e21c4583596c69a38bd43ce23eca05176f34e0c8666e669d6d968c0bcdd83ea5847b6a3443600e418020bdb7b96e6cb20e5f7050a76ec1be610be4b7dc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
409d59929fa3a3f7cb804332de0714be

SHA1
c54f9e9ce40f7cf10da04ef3165cf47ea35bf97c

SHA256
549877c70613e7077d293b6cce7f30b06ed2dd2737aafdf271a03f2f2590419a

SHA512
a7ae2ae423a20632426f9b098567ed1fb7f8e8c3e58389c9dce8271f6917f372a45767a84cd29d4d0b63f52e0e9ce4ee2d92c0aaef1e570ca9012255e1bba48e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c330c4a29b48cc00d9bec985495495d8

SHA1
363b7072aeafe5e40220fe8a8bf0dbf71350718c

SHA256
2b49ef9f11a9b9034be544b3ec2a02ff7db592f3fb3d0fe0f70bf7e497d7ee98

SHA512
36cc0ad2648f2bef7674968cf194ec6ca26e5d66c255ec26553b58041855525eb89d29dce4e465960e695bcaedcdfead1d208ebd9b4962f7aad1ff71681e5dbd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
64KB

MD5
987a07b978cfe12e4ce45e513ef86619

SHA1
22eec9a9b2e83ad33bedc59e3205f86590b7d40c

SHA256
f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

SHA512
39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\AppData\Local\Temp\438C.tmp\438D.tmp\438E.vbs

Filesize
710B

MD5
3bafc447cf86b66198f84690cb592adb

SHA1
5d16e560003b0ca1efa914aa0960fa84dbe1a0a6

SHA256
b96a442adc718e9e0981b1c3bea2c8172f6c5b2c8c1fecda5c311c95728bafff

SHA512
f0aaef88ff735c8823cf83bf513a95084ccc617aa97bfed8ee86dc1366ae8cef679a7b5bf48116370493e0074fd7f56ce7e5e9f22bfbd8dd6f2f7c8489419700

Download Submit
C:\Users\Admin\AppData\Local\Temp\438C.tmp\Horror8.bat

Filesize
915B

MD5
36fcf85ec52716f5fd8ea625a11c13c6

SHA1
60a720249c6bb3617e904445c247487dba96af9c

SHA256
3aba2d676284209730ff20b28a8415a3c41c88f402301b14437040bf2baebe0c

SHA512
1ba72a3ea4cf1014f0072184067611448276fff273f803c829d1f6bbeb6dd24c7dca41eada5b78f2ddc7dabadf5c5a66e11cd4f8a5aea31d261a69ef186d09f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\438C.tmp\HorrorGui.exe

Filesize
308KB

MD5
b2653aa06a2253e8155eb81535b20e6a

SHA1
0cf61fc537d8d73c71724febd0f1f34a6fddc838

SHA256
b4e106e22c4d3e51c87d3d5853298210572ab2834f5e2a0beaf1df7d96c57d29

SHA512
143694740660ac46f0c6c78903e8378fd402b5338dfb68c3e4a148f6f83036eaea3be6bda160d59ed1c5b52ba235823e284a0564ab9dbedcc3d3a6e40584fd98

Download Submit
C:\Users\Admin\AppData\Local\Temp\438C.tmp\TrashMBR.exe

Filesize
47KB

MD5
87f09f4a202bf9c0adcf6fed942aa703

SHA1
96bf11ff017e31ec2242c0024c372628c40cbd4f

SHA256
acf8abe9bd2f61840a247b4796ebedad20f69a85dbdf8a4100f5d7d306b064b1

SHA512
85202719aa875b2697ae3082a79a3ca7c1e1be377d6b19f9f159488a5f9d6ec6e9ec35352b067a1bc15546165764acb108c11203bf482ea43684e433717eee58

Download Submit
C:\Users\Admin\AppData\Local\Temp\438C.tmp\clingclang.wav

Filesize
13.1MB

MD5
1c723b3b9420e04cb8845af8b62a37fa

SHA1
3331a0f04c851194405eb9a9ff49c76bfa3d4db0

SHA256
6831f471ee3363e981e6a1eb0d722f092b33c9b73c91f9f2a9aafa5cb4c56b29

SHA512
41f4005ec2a7e0ee8e0e5f52b9d97f25a64a25bb0f00c85c07c643e4e63ea361b4d86733a0cf719b30ea6af225c4fcaca494f22e8e2f73cda9db906c5a0f12ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\438C.tmp\music.vbs

Filesize
227B

MD5
8b703f9c48eb3724348af746e7610061

SHA1
599aa1820096e92546ea8d863d46cc49404e19e6

SHA256
e8cd555c43973e3b2e6fa0e80d602abc3d7c43a17bc51a6d0ba08e20ea3feadd

SHA512
d38e39e3f9ff71f68d3d851b635bcc27939656ec085369652a324d8b0c95042e722a07b0b06a0a25f0f2b51d5ad1addc3174c472bda3f86cbf28376ba4870208

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 60212.crdownload

Filesize
12.4MB

MD5
846d847d9b1247c57824d5d2601a7faf

SHA1
2119dccee1e98af31fd193cf38bbfd8614f183bb

SHA256
ba8fa2c240edfc35c3078fcf31b87c0e1af4404dfc1f52e0d5640edb061355fc

SHA512
8cbad0562c13f997fd2e90e6f3a998cdbd2c207592c1d85e6bcf5c794a65bbf2322355a33c9d1af4f03519447c397e7b34dfea179c30d1a054d32d6031c723ec

Download Submit
memory/4588-310-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download