hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke[.]98[.]exe

max time kernel
442s
max time network
495s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09-11-2024 17:59

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe

Score

8^/10

discovery evasion persistence ransomware upx

Malware Config

Signatures

Disables Task Manager via registry modification
evasion
Downloads MZ/PE file
Executes dropped EXE 10 IoCs

Processes:

WinNuke.98.exeWinNuke.98.exe000.exe000.exe000.exe000.exe000.exe000.exe000.exe000.exe

pid process

4088 WinNuke.98.exe
2556 WinNuke.98.exe
5764 000.exe
5108 000.exe
3052 000.exe
3848 000.exe
2244 000.exe
2396 000.exe
5588 000.exe
4548 000.exe

pid	process
4088	WinNuke.98.exe
2556	WinNuke.98.exe
5764	000.exe
5108	000.exe
3052	000.exe
3848	000.exe
2244	000.exe
2396	000.exe
5588	000.exe
4548	000.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

000.exe000.exe000.exe000.exe000.exe

description	ioc	process
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\Z:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\P:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\V:	000.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\N:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\E:	000.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\O:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\R:	000.exe
File opened (read-only)	\??\W:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\I:	000.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

107 raw.githubusercontent.com
108 raw.githubusercontent.com

flow	ioc
107	raw.githubusercontent.com
108	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 7 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

000.exe000.exe000.exe000.exe000.exe000.exe000.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	000.exe

Sets desktop wallpaper using registry 2 TTPs 7 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

000.exe000.exe000.exe000.exe000.exe000.exe000.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1669812756-2240353048-2660728061-1000\Control Panel\Desktop\Wallpaper	000.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 590471.crdownload	upx
behavioral3/memory/4448-761-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral3/memory/1460-777-0x0000000000400000-0x0000000000420000-memory.dmp	upx
behavioral3/memory/4448-798-0x0000000000400000-0x0000000000420000-memory.dmp	upx

Drops file in Program Files directory 2 IoCs

Processes:

setup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\2849ee04-3577-4eb8-a03a-c6d6a32a1950.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241109180017.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Program crash 4 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

3044 4548 WerFault.exe 000.exe
808 5588 WerFault.exe 000.exe
3200 2396 WerFault.exe 000.exe
5980 2396 WerFault.exe 000.exe

pid	pid_target	process	target process
3044	4548	WerFault.exe	000.exe
808	5588	WerFault.exe	000.exe
3200	2396	WerFault.exe	000.exe
5980	2396	WerFault.exe	000.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

000.exe000.execmd.execmd.exe000.execmd.execmd.exe000.exeWinNuke.98.exe000.exe000.exe000.exe000.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinNuke.98.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 12 IoCs

evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid	process
3892	taskkill.exe
4220	taskkill.exe
4476	taskkill.exe
3840	taskkill.exe
2436	taskkill.exe
1488	taskkill.exe
5320	taskkill.exe
5376	taskkill.exe
5280	taskkill.exe
6112	taskkill.exe
228	taskkill.exe
3544	taskkill.exe

Modifies registry class 7 IoCs

Processes:

000.exe000.exe000.exe000.exe000.exe000.exe000.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsedge.exe

pid	process
2228	msedge.exe
2228	msedge.exe
648	msedge.exe
648	msedge.exe
3748	identity_helper.exe
3748	identity_helper.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
5604	msedge.exe
848	msedge.exe
848	msedge.exe
4220	msedge.exe
4220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

648 msedge.exe
648 msedge.exe
648 msedge.exe
648 msedge.exe
648 msedge.exe
648 msedge.exe
648 msedge.exe
648 msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

000.exe000.exe000.exe000.exe000.exe

description	pid	process
Token: SeShutdownPrivilege	3052	000.exe
Token: SeCreatePagefilePrivilege	3052	000.exe
Token: SeShutdownPrivilege	5764	000.exe
Token: SeCreatePagefilePrivilege	5764	000.exe
Token: SeShutdownPrivilege	5108	000.exe
Token: SeCreatePagefilePrivilege	5108	000.exe
Token: SeShutdownPrivilege	3848	000.exe
Token: SeCreatePagefilePrivilege	3848	000.exe
Token: SeShutdownPrivilege	2244	000.exe
Token: SeCreatePagefilePrivilege	2244	000.exe

Suspicious use of FindShellTrayWindow 48 IoCs

Processes:

msedge.exe

pid	process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe
648	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

Processes:

000.exe000.exe000.exe000.exe000.exe000.exe000.exe

pid	process
5108	000.exe
5108	000.exe
3052	000.exe
3052	000.exe
5764	000.exe
5764	000.exe
2244	000.exe
2244	000.exe
3848	000.exe
3848	000.exe
2396	000.exe
2396	000.exe
5588	000.exe
5588	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 648 wrote to memory of 324	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 324	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2348	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2228	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 2228	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe
PID 648 wrote to memory of 5416	648	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Virus/WinNuke.98.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x124,0x134,0x7fffd43746f8,0x7fffd4374708,0x7fffd4374718
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6bb735460,0x7ff6bb735470,0x7ff6bb735480
    3⤵
    PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1912 /prefetch:1
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:2208
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4088
- C:\Users\Admin\Downloads\WinNuke.98.exe
  "C:\Users\Admin\Downloads\WinNuke.98.exe"
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4220
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5764
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:452
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5376
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3544
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:220
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:3836
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:5108
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3944
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:6112
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:1488
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:4620
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:416
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3052
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5020
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5280
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3840
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:2220
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:5260
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2244
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:752
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:4220
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:2436
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:3736
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:5076
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3848
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4660
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:228
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:4476
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:1000
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:4160
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5588 -s 1068
    3⤵
    - Program crash
    PID:808
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - Modifies WinLogon
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2396
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
    3⤵
    PID:4948
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im explorer.exe
      4⤵
      Kills process with taskkill
      PID:5320
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      Kills process with taskkill
      PID:3892
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' set FullName='UR NEXT'
      4⤵
      PID:2192
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic useraccount where name='Admin' rename 'UR NEXT'
      4⤵
      PID:848
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1960
    3⤵
    - Program crash
    PID:3200
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 1960
    3⤵
    - Program crash
    PID:5980
- C:\Users\Admin\Downloads\000.exe
  "C:\Users\Admin\Downloads\000.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4548
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4548 -s 1068
    3⤵
    - Program crash
    PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2100,9504354394493521605,14817466330546559032,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:3132
- C:\Users\Admin\Downloads\HMBlocker.exe
  "C:\Users\Admin\Downloads\HMBlocker.exe"
  2⤵
  PID:4448
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 6 /f
    3⤵
    PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
    3⤵
    PID:2396
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 2503326475 /t REG_SZ /d "C:\Users\Admin\2503326475\2503326475.exe" /f
      4⤵
      PID:3436
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\HMBlocker.exe\"" /f
    3⤵
    PID:2792
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce /v 2503326475_del /t REG_SZ /d "cmd /c del \"C:\Users\Admin\Downloads\HMBlocker.exe\"" /f
      4⤵
      PID:1744
- C:\Users\Admin\Downloads\HMBlocker.exe
  "C:\Users\Admin\Downloads\HMBlocker.exe"
  2⤵
  PID:4836
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 6 /f
    3⤵
    PID:6088
- C:\Users\Admin\Downloads\HMBlocker.exe
  "C:\Users\Admin\Downloads\HMBlocker.exe"
  2⤵
  PID:3368
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 6 /f
    3⤵
    PID:2116
- C:\Users\Admin\Downloads\HMBlocker.exe
  "C:\Users\Admin\Downloads\HMBlocker.exe"
  2⤵
  PID:5244
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 6 /f
    3⤵
    PID:1976
- C:\Users\Admin\Downloads\HMBlocker.exe
  "C:\Users\Admin\Downloads\HMBlocker.exe"
  2⤵
  PID:1460
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 6 /f
    3⤵
    PID:4440
- C:\Users\Admin\Downloads\HMBlocker.exe
  "C:\Users\Admin\Downloads\HMBlocker.exe"
  2⤵
  PID:4312
- - C:\Windows\SysWOW64\shutdown.exe
    "C:\Windows\System32\shutdown.exe" /r /t 6 /f
    3⤵
    PID:3016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 5588 -ip 5588
1⤵
PID:3496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4548 -ip 4548
1⤵
PID:5276

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 2396 -ip 2396
1⤵
PID:4088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2396 -ip 2396
1⤵
PID:5140

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39e5855 /state1:0x41c64e6d
1⤵
PID:5436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9fc751d5fa08ca574eba851a781b900

SHA1
963c71087bd9360fa4aa1f12e84128cd26597af4

SHA256
360b095e7721603c82e03afa392eb3c3df58e91a831195fc9683e528c2363bbb

SHA512
ecb8d509380f5e7fe96f14966a4d83305cd9a2292bf42dec349269f51176a293bda3273dfe5fba5a32a6209f411e28a7c2ab0d36454b75e155fc053974980757

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d9a93ee5221bd6f61ae818935430ccac

SHA1
f35db7fca9a0204cefc2aef07558802de13f9424

SHA256
a756ec37aec7cd908ea1338159800fd302481acfddad3b1701c399a765b7c968

SHA512
b47250fdd1dd86ad16843c3df5bed88146c29279143e20f51af51f5a8d9481ae655db675ca31801e98ab1b82b01cb87ae3c83b6e68af3f7835d3cfa83100ad44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
df0fe1d6f8f13f41d721d1bd438281e6

SHA1
46d8ce3b59b80e3c089434265028c94a0155ff2e

SHA256
1b4781a30d1b1980f699aed974e851075fdd659a5955eabeeaa71bf74acf6974

SHA512
d137b4ecb201a5c010288bee111f4e0df08f0d0cbc308cc537345e62f79bc98ae69a830612bcc4715da10ac595a9a6fbfd061f1df21103d1748b43f7a5f5e640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57f31a.TMP

Filesize
48B

MD5
e3d922a851629a798f9f518c6c0ea9cb

SHA1
4ce4a390dc15f856702f198488511cbc8573069c

SHA256
35728400740bbe22e8ba2c0aef1566e3da38410a68e991a2d0c10cf912e90e4d

SHA512
8d7016f5d5149f31520908dcb9604e8ef3e916ea9ce9874b5345b7825d5f064aace961732b9a80c931a19040a64ac9e233bc1144cc8b7fba368520d50cc01f96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
70KB

MD5
e5e3377341056643b0494b6842c0b544

SHA1
d53fd8e256ec9d5cef8ef5387872e544a2df9108

SHA256
e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

SHA512
83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
496B

MD5
f5efb2cf9219179700770c056a06e17b

SHA1
f821ce0477c2d948f59e90d4e75db6900b1f5f23

SHA256
159439d953aaa2a0e3226ddb534e5d7c96cf304d4b8e92e62e3c91354526ccdf

SHA512
c8a717e42bd30e0fb9b2cdaca6142f7e048fb8133b0168d0f53748bb60cca6ed5ee6b1d26939f7206b033e307bc000e521a5e399aeee1017d8e5ea7856897a52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
804fe0c28aea695b6c10b9228801a253

SHA1
1bd00fdba9c2e15b365becc9c4e7c94192618055

SHA256
95b0d397bbb823827c2b173c79f887a2998d9fc9b5d82258ac2ad4a3ef7fa988

SHA512
6fe5a11de8caa14d739aadf45e8515beae305d96154d393a8e03e4f5c595b51a4a5b8d815a6670d8ccbb079d80960539233c8437d96af225f2e9760e6990c14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58ad52.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
67e0bc037f427f94bd408a745bc13c3d

SHA1
460792fa4fadea89af95cb1e9c6005bef651051e

SHA256
eb0d95fb5e8e1b05b51891fe3743b6eb0280aadbacc2c133679f9b3b7d760faf

SHA512
9161280682d14b508876fa576b7114ff67f8eec713185eb8c69e3f81be800f416ed2e3a01e3d396b65de9575bd682b940b2ecf417ea100da8e11e8ad08fd76f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dc8cb809ae4a59fa56ccbaa97cb67a24

SHA1
e6a6f4580251603b3b91161c12efb4f3ba764178

SHA256
2ca81eaaa6a5e17c263ec335d262a31d89d23ae86c0aeb56f60f499c8b5b9bd9

SHA512
4694b88a3908357f08e174c58e391ee64c6052f3db8870dc77b7a5add62501c9149aae40c40d14d4ced1d4703ee3b0307ad207cb35420b0f731f59d483840660

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4b1f9ddf4e5016a72df3fae29532503b

SHA1
ad2f89b088d5b018fbec2be47bb8231ce6d7439f

SHA256
130026b387a9c826120f43f04a09da2bbad07d50198bcf6fb59c4ba3d62e653d

SHA512
692f4e7b45ebfd2b84254835e4fbf669ff39a6bccde72947a219c153e91d41dda0bc8611a1002cbbc776da19954cbae1330952882d3ec41a00911b0dbf5f2558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c08a364daee7ad24c9df6022b70b9808

SHA1
4f3f4541452ab5387f75c027f703025cbab999fc

SHA256
100954d4b436964ee1a296bbe4837dd3c6384007fde2611cccbeedd3b70b9435

SHA512
0399511564b758a8a5a7ef71eaf39e044054f6d0650565a9b518b15a44d89e8b81f2c4eccb13767cc4d1e8d9d06d52fe440d866ff7bdd7928cdd8387ec01f2f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a5db3d07f8287ef4d0efa64f5907ad1c

SHA1
3a594ced4feba543d919ec44d1b0d1911f4ad56f

SHA256
deb3c12d2446100d9fcb03322c41209cd2c7582debc0f7e55422a1568793e873

SHA512
b15095d34fa2d15bd351f2186851c728f9159570968ee19c9b25c3e856a84268fd9c543aab12e0d172b6df6079b7b2ebaf48f6373f935db4dc81a78c92bfef37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8166cd70306c612b9f0a7c31938ccd49

SHA1
6e0dd9051decde5c27d28b5df2a227c6a8e25822

SHA256
fc1ad66d5808f1588d17545888e68c2733b1aba7e528bb08c7f895f45216516f

SHA512
b91cc4fa04c8135924da10901ee2e406c900cd03eb08b889dc4d95f27d6018a980a6f9f39de571a33cd3aa5cb49208f66e970d2719bc504d3569027c1fe21d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e117acd6e7bc62ec1c6cb13c77eecea

SHA1
80867a2cd184294627ff10759e617a6fba2abdd6

SHA256
aeceff68252fdc5006fc68d0f535b753cabcf47d0075bce2df23aa9e3d0b7204

SHA512
ff92eb2cd6e0b535deba3f3b2202235734d4fca056411a8e09081dbdf3c7ad5bf39ac357ef78890023ed68e7607c3173c81f44386a66814605617698be404bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61b0f781665c244fe59dbf09d23e7799

SHA1
19d0397a1b47211b3ec83d93756e02c851ddf16b

SHA256
74c9ca547cf9393a2833b14a1c210c6e27bc83b444d6ddc3eb4a50bc652e0b24

SHA512
6156be82e3374475813b0e33df3132c80e0d98105a231b871bbddf28c57c187d8c7d58456cace41455dd37a279601198bd9c5692c3704cd0819b6c2fb91d1bd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f9055ea0f42cb1609ff65d5be99750dc

SHA1
6f3a884d348e9f58271ddb0cdf4ee0e29becadd4

SHA256
1cacba6574ba8cc5278c387d6465ff72ef63df4c29cfbec5c76fbaf285d92348

SHA512
b1937bc9598d584a02c5c7ac42b96ed6121f16fe2de2623b74bb9b2ca3559fc7aff11464f83a9e9e3002a1c74d4bb0ee8136b0746a5773f8f12f857a7b2b3cb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d3412a01d4c3df1df43f94ecd14a889a

SHA1
2900a987c87791c4b64d80e9ce8c8bd26b679c2f

SHA256
dd1511db0f7bf3dc835c2588c1fdd1976b6977ad7babe06380c21c63540919be

SHA512
7d216a9db336322310d7a6191ebac7d80fd4fa084413d0474f42b6eff3feb1baf3e1fb24172ea8abcb67d577f4e3aea2bc68fdb112205fc7592a311a18952f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
77f8103e5c7a39241efd4f5a04a34e5b

SHA1
6aa6ab6be4f488660f14fd3f3696239030d0d5d9

SHA256
536b1048efd62bb6a6b4b0ad3a2d67a8f1417c95e79b83c6057799a6569a79e1

SHA512
eb8f61aefb75d9af17d95a8e7e2f564439247110c1f4c138b68cab76cf2152b6f79ed8e09b8d108c92452c79f9adc7c2a7bbd4811cfbda09d760687d4568f1ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
04b0bbfb4d08ce2ed5bf6bbff8a3d792

SHA1
4f9b7f9c01915073ef0a9908de8c60e029de2e06

SHA256
641be28603cf0c4545b05d9541d74b2d9ff47047ec6a5bd6603745ade4479edc

SHA512
db30cb427717edc0cfd70f1e52d6b7805d13132c837863472c6fdc9ccb2cf032fc5003f7e9ec1940bea3c9f758ea213d765f8de7ba0a40fc4f9cee98417bcea5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e45065b322f61c26a291187cc1a5ee9

SHA1
8f376566af60bbffb90636e8d4a68d93c5ca6ffb

SHA256
68350490fa4f97325fa6bc42dfae3c944b3c6279958b1e4d144df60c51acea97

SHA512
37faad1295d582d15303a9dc4c417560dcad6caaa51a58bf7c05bbaeb6788afcf2428ea537c98f2c70314c831f776d9fd956f70967d822a78ae5c0b823a61fee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
cbd28a413747dc71f1e64fd2e9640b99

SHA1
1c97fe4327079e5952985b471e788f0f02750c23

SHA256
e81a45a5aa0e0027a9520b03f20f5b627c69ec2bd4a60e07a8ac59eb12025512

SHA512
987dcf452ac966c56d52ef2362bbf665c7572a4e10ce28bbe1210db59e493c81c6e6f3977de9cadbb42f7a0d23c31faef4c8f2c32384657da66851a2de835307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
3ec079317a113e5ff8222f819dd48ca6

SHA1
57e4ebc9c08697f6a82b014cfc81ca1950b9cedc

SHA256
065ab20a6331e32d6156cfeeab41cc01d63f538a007f280911585c278fcc54aa

SHA512
7ae6ac5cadf173bbb574052289ea5e39446ceee762ee30eb229d9facd6863c74085cb7e0ffcc599e35bb9ecafbb34faa4d4c1a905716a273f8580b52cf6b96ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5dd3dd.TMP

Filesize
864B

MD5
d3acfff04f6835c267d8c6bc9e3bcf8f

SHA1
34456a1d907ba84b1667b4cbf88e0822b513ec0e

SHA256
35cfd7400a0db1e93c9f20437ae48aa582a314e3c0b9fe62e76fbc6193d7a1c6

SHA512
4da468f246e78fe6a59d6ea602129f185d81679558c62d2e4a068ff82af2fd4732f49b467149e2a0e7849bce2b254311a7319c4718d23846fa150016bd8b733a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d8622361-80c5-43ce-b6e5-3a1b52b9b46e.tmp

Filesize
5KB

MD5
e81b0228ffb6c80d90743c40297d3e33

SHA1
3f74d08bce6f07b4eb6bd5e2d0b3e69841247950

SHA256
30780e3ceffa30112ed96194abbd959a29a2a0ce30bff4cd5abd9e227a793bec

SHA512
5c245df81fa54b3c5be273bea4cdbc1a88123c0092d645d184081df8cda5770d93b9622d26cd474c64e57ce8574d8b582f664d74174da01d0d0a212385c39a27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
fc577ce65ae934b854cef2b06ed7b839

SHA1
0755d83279037490eb360d684e0403ee76dd04bd

SHA256
0d7674f0364d3e9ea900e6a6ca2608f258c464e0ee8cf9d6c247b4e5d3ea139b

SHA512
9c5b35e8086fb11575f0132bde3c5ed4d3a4cbc9f4d27034cad2addd4c8137601410f2471140b57155bbf600d42edc9947b3d331c7906331f46e344454a0bb70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cb7a3bc69275edea171aba392a3fa061

SHA1
bc3ee64c2359d1eebc926168d459bc43421dc618

SHA256
cae8770786b7f143134df2642054856ba50a3452ef90f6bfb28f136e351fffa4

SHA512
c799ffb36c4752191445a5f2bc279badc2fd2efa61035e7a1e70fb3a654976b58f9b764f29beead4ee3a3ed8e1c5c9e11b57160f4e276c225f1259cec7a724b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e0d41ecfd644713ada294ad36d8cc86e

SHA1
4357362398c4bab6884fb680dc4977757d338dd0

SHA256
06c5fb0c47f0e700edec44e4384ea1da29fc8fa1017c82bcb5fd50650f9cc384

SHA512
60c286c506f2a80d8a30a69e166f10d314f25de8bb40919077ee5ef71dc77e8f016a6b5a044b05a8435755b360d3f7c88571234d8a36c6cee35b1e1ec120fe62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6404aa760d9f406e1c6565de0b540f04

SHA1
b877b519c9964d2c200ba438f44bb7e6b07acf81

SHA256
a4c72694dff42dc54d9f485b037740a29c5557ce8f04c112c446eec1079876a7

SHA512
14db4e6617587708f20a74f38f8185329801007ecd373751c9ade81dc0c4db1dbb86509b31bb652c89e4f1b805e1252df13dde856f72c41ceeedeb90e04ab389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
15dca783c45904ef1c7feb78d860b707

SHA1
73e667941e7d128d45551474e90942ea722fdae7

SHA256
10189fae3230b29cb47a089b818e309810613360e832c5308195fd25ad50c455

SHA512
8058a829a2bf6b0369cfcb6bcfb2b67d6d9b741c0e589d1d277fc3321599cd743aa3f59f36320028488058550ba69dc44a803ae79949797a3899638b9c4d26cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
72670bf21a8fcb13a469dc496d346dc0

SHA1
8a36e70ecceea351752128b5ee2798c8d881d9cf

SHA256
5f28b261fe1f5b40faaac7708c61a5e64e6f3f8bc1db21eef1c3602fb86e53d3

SHA512
e44fd0830dfd293f8bf514062c784e62a954333720ea8451ed03b793d69bb41bf8bd4e0e1e734181c72a388fdd791fca98d2ce560992ba24ffcefe8ba9cb4ecc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD

Filesize
498B

MD5
90be2701c8112bebc6bd58a7de19846e

SHA1
a95be407036982392e2e684fb9ff6602ecad6f1e

SHA256
644fbcdc20086e16d57f31c5bad98be68d02b1c061938d2f5f91cbe88c871fbf

SHA512
d618b473b68b48d746c912ac5fc06c73b047bd35a44a6efc7a859fe1162d68015cf69da41a5db504dcbc4928e360c095b32a3b7792fcc6a38072e1ebd12e7cbe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
5433eab10c6b5c6d55b7cbd302426a39

SHA1
c5b1604b3350dab290d081eecd5389a895c58de5

SHA256
23dbf7014e99e93af5f2760f18ee1370274f06a453145c8d539b66d798dad131

SHA512
207b40d6bec65ab147f963a5f42263ae5bf39857987b439a4fa1647bf9b40e99cdc43ff68b7e2463aa9a948284126ac3c9c7af8350c91134b36d8b1a9c61fd34

Download Submit
C:\Users\Admin\AppData\Local\Temp\icon.ico

Filesize
361KB

MD5
a4b9662cf3b6ea6626f6081c0d8c13f3

SHA1
946501d358e5e3b10223431e474607e0eb248796

SHA256
84a1c2713642090523f05d9fb015c537fd210d3200cadaf442bb67cf1834b356

SHA512
4e94dcf9200bfd6d685f93acaa0bd93d49bb0fe2229f3105e22b8893e0d530ad15e8dce5be6db1c1db393fcc169defc43f12e35308be30b054631487d16cbf33

Download Submit
C:\Users\Admin\AppData\Local\Temp\one.rtf

Filesize
403B

MD5
6fbd6ce25307749d6e0a66ebbc0264e7

SHA1
faee71e2eac4c03b96aabecde91336a6510fff60

SHA256
e152b106733d9263d3cf175f0b6197880d70acb753f8bde8035a3e4865b31690

SHA512
35a0d6d91178ec10619cf4d2fd44d3e57aa0266e1779e15b1eef6e9c359c77c384e0ffe4edb2cde980a6847e53f47733e6eacb72d46762066b3541dee3d29064

Download Submit
C:\Users\Admin\AppData\Local\Temp\rniw.exe

Filesize
76KB

MD5
9232120b6ff11d48a90069b25aa30abc

SHA1
97bb45f4076083fca037eee15d001fd284e53e47

SHA256
70faa0e1498461731f873d3594f20cbf2beaa6f123a06b66f9df59a9cdf862be

SHA512
b06688a9fc0b853d2895f11e812c48d5871f2793183fda5e9638ded22fc5dc1e813f174baedc980a1f0b6a7b0a65cd61f29bb16acc6dd45da62988eb012d6877

Download Submit
C:\Users\Admin\AppData\Local\Temp\text.txt

Filesize
396B

MD5
9037ebf0a18a1c17537832bc73739109

SHA1
1d951dedfa4c172a1aa1aae096cfb576c1fb1d60

SHA256
38c889b5d7bdcb79bbcb55554c520a9ce74b5bfc29c19d1e4cb1419176c99f48

SHA512
4fb5c06089524c6dcd48b6d165cedb488e9efe2d27613289ef8834dbb6c010632d2bd5e3ac75f83b1d8024477ebdf05b9e0809602bbe1780528947c36e4de32f

Download Submit
C:\Users\Admin\AppData\Local\Temp\v.mp4

Filesize
81KB

MD5
d2774b188ab5dde3e2df5033a676a0b4

SHA1
6e8f668cba211f1c3303e4947676f2fc9e4a1bcc

SHA256
95374cf300097872a546d89306374e7cf2676f7a8b4c70274245d2dccfc79443

SHA512
3047a831ed9c8690b00763061807e98e15e9534ebc9499e3e5abb938199f9716c0e24a83a13291a8fd5b91a6598aeeef377d6793f6461fc0247ec4bbd901a131

Download Submit
C:\Users\Admin\AppData\Local\Temp\windl.bat

Filesize
771B

MD5
a9401e260d9856d1134692759d636e92

SHA1
4141d3c60173741e14f36dfe41588bb2716d2867

SHA256
b551fba71dfd526d4916ae277d8686d83fff36d22fcf6f18457924a070b30ef7

SHA512
5cbe38cdab0283b87d9a9875f7ba6fa4e8a7673d933ca05deddddbcf6cf793bd1bf34ac0add798b4ed59ab483e49f433ce4012f571a658bc0add28dd987a57b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
3d049bd1e4a268105f12be46b2bca769

SHA1
f28c4ce4e2d2edaed2d8ea3a6a53e5d25e1d5b78

SHA256
f3520fe3900eab2a72bbfb5ae0efb7bc24d1c7ce13ab5135f083654b6fc4a414

SHA512
33828aad4a9b4bd3f1dfa52663498cf676fc8a763756e7e807686c8c118b07eb6a256fee483e5d64f86c1e23fb8c7c71731fcd6216f7da86066749adbcd138db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

Filesize
3KB

MD5
8597ee223783eefd22a425b470733e15

SHA1
3bafc491e56d7effd2672ac8e19387203ca0b158

SHA256
d302ec02fefadde77a18b30e52c4b3cc66885ce26db4293c6e1554934faf9a2f

SHA512
15330530e936afc2aaf178f7816648b9873909b3890a475683f35f54d164365c9af09e30ff5f0cf777c2cd6e260ead82e4794d0bd3cfd56e0ddfeac430c4327e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 169061.crdownload

Filesize
32KB

MD5
eb9324121994e5e41f1738b5af8944b1

SHA1
aa63c521b64602fa9c3a73dadd412fdaf181b690

SHA256
2f1f93ede80502d153e301baf9b7f68e7c7a9344cfa90cfae396aac17e81ce5a

SHA512
7f7a702ddec8d94cb2177b4736d94ec53e575be3dd2d610410cb3154ba9ad2936c98e0e72ed7ab5ebbcbe0329be0d9b20a3bcd84670a6d1c8d7e0a9a3056edd2

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 590471.crdownload

Filesize
48KB

MD5
21943d72b0f4c2b42f242ac2d3de784c

SHA1
c887b9d92c026a69217ca550568909609eec1c39

SHA256
2d047b0a46be4da59d375f71cfbd578ce1fbf77955d0bb149f6be5b9e4552180

SHA512
04c9fa8358944d01b5fd0b6d5da2669df4c54fe79c58e7987c16bea56c114394173b6e8a6ac54cd4acd081fcbc66103ea6514c616363ba8d212db13b301034d8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 694043.crdownload

Filesize
6.7MB

MD5
f2b7074e1543720a9a98fda660e02688

SHA1
1029492c1a12789d8af78d54adcb921e24b9e5ca

SHA256
4ea1f2ecf7eb12896f2cbf8683dae8546d2b8dc43cf7710d68ce99e127c0a966

SHA512
73f9548633bc38bab64b1dd5a01401ef7f5b139163bdf291cc475dbd2613510c4c5e4d7702ecdfa74b49f3c9eaed37ed23b9d8f0064c66123eb0769c8671c6ff

Download Submit
\??\pipe\LOCAL\crashpad_648_CZJZABXBYGQRUWAH

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1460-777-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/2244-661-0x000000000C4F0000-0x000000000C500000-memory.dmp

Filesize
64KB

Download
memory/2244-634-0x000000000BE80000-0x000000000BE90000-memory.dmp

Filesize
64KB

Download
memory/2244-635-0x000000000BE80000-0x000000000BE90000-memory.dmp

Filesize
64KB

Download
memory/2244-636-0x000000000BE80000-0x000000000BE90000-memory.dmp

Filesize
64KB

Download
memory/2244-654-0x000000000BE80000-0x000000000BE90000-memory.dmp

Filesize
64KB

Download
memory/2244-653-0x000000000BE80000-0x000000000BE90000-memory.dmp

Filesize
64KB

Download
memory/2244-652-0x000000000C4F0000-0x000000000C500000-memory.dmp

Filesize
64KB

Download
memory/2244-651-0x000000000C4F0000-0x000000000C500000-memory.dmp

Filesize
64KB

Download
memory/2244-637-0x000000000BE80000-0x000000000BE90000-memory.dmp

Filesize
64KB

Download
memory/3052-628-0x000000000C790000-0x000000000C7A0000-memory.dmp

Filesize
64KB

Download
memory/3052-648-0x000000000C790000-0x000000000C7A0000-memory.dmp

Filesize
64KB

Download
memory/3052-650-0x000000000C790000-0x000000000C7A0000-memory.dmp

Filesize
64KB

Download
memory/3052-646-0x000000000CF30000-0x000000000CF40000-memory.dmp

Filesize
64KB

Download
memory/3052-660-0x000000000CF30000-0x000000000CF40000-memory.dmp

Filesize
64KB

Download
memory/3052-644-0x000000000CF30000-0x000000000CF40000-memory.dmp

Filesize
64KB

Download
memory/3052-626-0x000000000C790000-0x000000000C7A0000-memory.dmp

Filesize
64KB

Download
memory/3052-629-0x000000000C790000-0x000000000C7A0000-memory.dmp

Filesize
64KB

Download
memory/3052-627-0x000000000C790000-0x000000000C7A0000-memory.dmp

Filesize
64KB

Download
memory/3848-639-0x000000000C6C0000-0x000000000C6D0000-memory.dmp

Filesize
64KB

Download
memory/3848-638-0x000000000C6C0000-0x000000000C6D0000-memory.dmp

Filesize
64KB

Download
memory/3848-641-0x000000000BEB0000-0x000000000BEC0000-memory.dmp

Filesize
64KB

Download
memory/3848-642-0x000000000C6C0000-0x000000000C6D0000-memory.dmp

Filesize
64KB

Download
memory/3848-623-0x000000000BEB0000-0x000000000BEC0000-memory.dmp

Filesize
64KB

Download
memory/3848-624-0x000000000BEB0000-0x000000000BEC0000-memory.dmp

Filesize
64KB

Download
memory/3848-622-0x000000000BEB0000-0x000000000BEC0000-memory.dmp

Filesize
64KB

Download
memory/3848-625-0x000000000BEB0000-0x000000000BEC0000-memory.dmp

Filesize
64KB

Download
memory/3848-640-0x000000000BEB0000-0x000000000BEC0000-memory.dmp

Filesize
64KB

Download
memory/4448-762-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/4448-763-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/4448-764-0x0000000000460000-0x0000000000461000-memory.dmp

Filesize
4KB

Download
memory/4448-798-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4448-761-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/5108-657-0x000000000A1D0000-0x000000000A1E0000-memory.dmp

Filesize
64KB

Download
memory/5108-655-0x000000000A880000-0x000000000A890000-memory.dmp

Filesize
64KB

Download
memory/5108-528-0x0000000006D30000-0x00000000072D6000-memory.dmp

Filesize
5.6MB

Download
memory/5108-630-0x000000000A1D0000-0x000000000A1E0000-memory.dmp

Filesize
64KB

Download
memory/5108-631-0x000000000A1D0000-0x000000000A1E0000-memory.dmp

Filesize
64KB

Download
memory/5108-600-0x0000000009ED0000-0x0000000009EDE000-memory.dmp

Filesize
56KB

Download
memory/5108-633-0x000000000A1D0000-0x000000000A1E0000-memory.dmp

Filesize
64KB

Download
memory/5108-599-0x0000000009F60000-0x0000000009F98000-memory.dmp

Filesize
224KB

Download
memory/5108-632-0x000000000A1D0000-0x000000000A1E0000-memory.dmp

Filesize
64KB

Download
memory/5108-662-0x000000000A880000-0x000000000A890000-memory.dmp

Filesize
64KB

Download
memory/5108-658-0x000000000A1D0000-0x000000000A1E0000-memory.dmp

Filesize
64KB

Download
memory/5108-656-0x000000000A880000-0x000000000A890000-memory.dmp

Filesize
64KB

Download
memory/5764-619-0x000000000C7E0000-0x000000000C7F0000-memory.dmp

Filesize
64KB

Download
memory/5764-649-0x000000000C7E0000-0x000000000C7F0000-memory.dmp

Filesize
64KB

Download
memory/5764-647-0x000000000C7E0000-0x000000000C7F0000-memory.dmp

Filesize
64KB

Download
memory/5764-645-0x000000000C760000-0x000000000C770000-memory.dmp

Filesize
64KB

Download
memory/5764-643-0x000000000C760000-0x000000000C770000-memory.dmp

Filesize
64KB

Download
memory/5764-659-0x000000000C760000-0x000000000C770000-memory.dmp

Filesize
64KB

Download
memory/5764-620-0x000000000C7E0000-0x000000000C7F0000-memory.dmp

Filesize
64KB

Download
memory/5764-621-0x000000000C7E0000-0x000000000C7F0000-memory.dmp

Filesize
64KB

Download
memory/5764-618-0x000000000C7E0000-0x000000000C7F0000-memory.dmp

Filesize
64KB

Download
memory/5764-516-0x0000000000CC0000-0x000000000136E000-memory.dmp

Filesize
6.7MB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads