Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/02/2025, 01:26

250213-btppra1pcz 10

17/01/2025, 20:14

250117-yz7h3s1qfw 10

17/01/2025, 20:12

250117-yy9l2sslcr 10

17/01/2025, 17:25

250117-vy9p9sxpez 10

17/01/2025, 17:21

250117-vw8eesyjfp 10

17/01/2025, 14:16

250117-rk9ass1rhk 10

17/01/2025, 14:12

250117-rhv1ds1lds 10

16/01/2025, 12:52

250116-p4et7a1mez 10

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20250113-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20250113-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    17/01/2025, 20:14

General

  • Target

    Malware-1-master/getr3kt.bat

  • Size

    13KB

  • MD5

    4e2a7f369378a76d1df4d8c448f712af

  • SHA1

    1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49

  • SHA256

    5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad

  • SHA512

    90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e

  • SSDEEP

    192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 7 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\getr3kt.bat"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4148
    • C:\Windows\system32\cscript.exe
      cscript x.js
      2⤵
      • Suspicious use of FindShellTrayWindow
      PID:2580
    • C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:748
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:5000
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4248
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:1628
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3040
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:4812
      • C:\Users\Admin\AppData\Roaming\MEMZ.exe
        "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Writes to the Master Boot Record (MBR)
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:1816
        • C:\Windows\SysWOW64\notepad.exe
          "C:\Windows\System32\notepad.exe" \note.txt
          4⤵
          • System Location Discovery: System Language Discovery
          PID:3356
        • C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
          "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1776
          • C:\Windows\splwow64.exe
            C:\Windows\splwow64.exe 12288
            5⤵
              PID:2240
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=what+happens+if+you+delete+system32
            4⤵
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:1784
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x140,0x144,0x148,0x11c,0x14c,0x7ffcfdcf46f8,0x7ffcfdcf4708,0x7ffcfdcf4718
              5⤵
                PID:4236
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
                5⤵
                  PID:4476
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
                  5⤵
                    PID:4656
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
                    5⤵
                      PID:2104
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
                      5⤵
                        PID:4156
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
                        5⤵
                          PID:5040
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
                          5⤵
                            PID:560
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
                            5⤵
                              PID:1172
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
                              5⤵
                                PID:2976
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
                                5⤵
                                  PID:3108
                                • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:8
                                  5⤵
                                    PID:4780
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
                                    5⤵
                                    • Drops file in Program Files directory
                                    PID:4916
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x2b8,0x2bc,0x2c0,0x294,0x11c,0x7ff7e0075460,0x7ff7e0075470,0x7ff7e0075480
                                      6⤵
                                        PID:2788
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:8
                                      5⤵
                                        PID:4680
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
                                        5⤵
                                          PID:3736
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
                                          5⤵
                                            PID:748
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
                                            5⤵
                                              PID:1472
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,2361597126537428968,7963715182315083229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6396 /prefetch:1
                                              5⤵
                                                PID:220
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pcoptimizerpro.com/
                                              4⤵
                                                PID:1428
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x144,0x148,0x14c,0x120,0x150,0x7ffcfdcf46f8,0x7ffcfdcf4708,0x7ffcfdcf4718
                                                  5⤵
                                                    PID:4884
                                                • C:\Windows\SysWOW64\calc.exe
                                                  "C:\Windows\System32\calc.exe"
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  • Modifies registry class
                                                  PID:1744
                                                  • C:\Windows\SysWOW64\win32calc.exe
                                                    "C:\Windows\System32\win32calc.exe"
                                                    5⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:3440
                                                • C:\Windows\SysWOW64\notepad.exe
                                                  "C:\Windows\System32\notepad.exe"
                                                  4⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:4228
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
                                            1⤵
                                              PID:2864
                                            • C:\Windows\System32\CompPkgSrv.exe
                                              C:\Windows\System32\CompPkgSrv.exe -Embedding
                                              1⤵
                                                PID:3440
                                              • C:\Windows\System32\CompPkgSrv.exe
                                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                1⤵
                                                  PID:2244
                                                • C:\Windows\system32\AUDIODG.EXE
                                                  C:\Windows\system32\AUDIODG.EXE 0x414 0x494
                                                  1⤵
                                                  • Suspicious use of AdjustPrivilegeToken
                                                  PID:1748

                                                Network

                                                MITRE ATT&CK Enterprise v15

                                                Replay Monitor

                                                Loading Replay Monitor...

                                                Downloads

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  1ab523be0df47b9c44c0863d39e9402e

                                                  SHA1

                                                  a41f981235db6719a25988be3f650f0dd44c5803

                                                  SHA256

                                                  65223a518625d4525c42fa0a46e7bc62cfbc9f4eed6570a7c10f639ccbb907ac

                                                  SHA512

                                                  865d0e948b80b911c029f4782d31bed455d6ae405823db137fe5582674f556312db9182f04417f876a4c04326183d97759abe5b114230a939417c9fe87449e6c

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  8b16630717cf81f638bae67ab57f5e76

                                                  SHA1

                                                  5767a40e7011584c074743df3ddca48d05c833aa

                                                  SHA256

                                                  687f4722fac01dbddcee3ad0b9bb4c5483d21a83538b049818fb3ea9f2b52cfd

                                                  SHA512

                                                  3718b25f887b0112db461060ee647ad4240bad91d82816e48659e15b9f1c94b4a637665ac258b025fdb6b3ae0349bc26802e4b6d8215846ebc01777ed5a6f771

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                  Filesize

                                                  152B

                                                  MD5

                                                  50a139aba944ca85ab4a0c154b01bc63

                                                  SHA1

                                                  e5b50e94fbafe168b3ece75fd6b750565c54f5df

                                                  SHA256

                                                  2653e90df1430a4f72648a6244c4477cdad72b6cdf600915ff6901239d3ff470

                                                  SHA512

                                                  cb041355dec7d56f1e1d3461aeba3ff54ab02bfb5249920e7cfcf669a4ccf72b66c0126abf867059c2886f0b2d0ca8764aff65a97e610b6ef33ef94b992333ea

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

                                                  Filesize

                                                  215KB

                                                  MD5

                                                  d474ec7f8d58a66420b6daa0893a4874

                                                  SHA1

                                                  4314642571493ba983748556d0e76ec6704da211

                                                  SHA256

                                                  553a19b6f44f125d9594c02231e4217e9d74d92b7065dc996d92f1e53f6bcb69

                                                  SHA512

                                                  344062d1be40db095abb7392b047b16f33ea3043158690cf66a2fa554aa2db79c4aa68de1308f1eddf6b9140b9ac5de70aad960b4e8e8b91f105213c4aace348

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  48B

                                                  MD5

                                                  c0b2f0b7b44ddf8db2e19344edaf2c4d

                                                  SHA1

                                                  6a293dc5e2e70255628d8d3e9a8e7ea1086a52af

                                                  SHA256

                                                  e06cc9dffab41cc90781725a61b7a389b3370623b54aba733a49de4a44de1ab3

                                                  SHA512

                                                  9e794d8639f1ec1952e40aa200dc97b232735426f457a6502d2361231145203e6f79ccfe18eda197d4348088e6929eb23289dbc130f4f95f97a12f5ee5658777

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  144B

                                                  MD5

                                                  c35b8257e1da369c7e8ad46141ed58f1

                                                  SHA1

                                                  57753e5bcbd6085f9ab41b4d1d3b5f8b299a4b8a

                                                  SHA256

                                                  c860ba9041af0422ea32fc46f4bc1d220381bcc93b27d4bc32236729671aacb8

                                                  SHA512

                                                  2f2fd21d74aaa94b890a138099bca47aa4dff4b792a3b93dd0f1af1dde315d899e83f88bb1c72072495e4ffb4a2148f199c7699a1470ce58c1ee0f9f7aadaabd

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                  Filesize

                                                  480B

                                                  MD5

                                                  4093c1a92a4fc40734da80aff559b1c1

                                                  SHA1

                                                  aea47603b8ccc569f3949308a312415533944ef1

                                                  SHA256

                                                  7ab5c81b9c242a45b5a6e1adce6c1736c2d056b32e35b5bd3c5c58ce7a0a4556

                                                  SHA512

                                                  182c1bf88e781c4c804c2a75ac717e03b46178ba892dcde298852cbed500e0c20af6e78bce9cb0f62ddfeacd428a59713a0c0158a0f84766b01ec8a22e6380b9

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                  Filesize

                                                  70KB

                                                  MD5

                                                  e5e3377341056643b0494b6842c0b544

                                                  SHA1

                                                  d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                  SHA256

                                                  e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                  SHA512

                                                  83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                                  Filesize

                                                  2KB

                                                  MD5

                                                  f89892ab88247af96a72d0122f8daf6b

                                                  SHA1

                                                  f46e2329dd216bb62a28e6d7f7e7e49f5973b6d5

                                                  SHA256

                                                  53fac1ecc1560b1b3485aaf088b2b4a62fbb91c0a3219d7aaf63a6b21cdf4e47

                                                  SHA512

                                                  698d3049b9cf2d49721694c55b0f8772e14de289693bb5697e4a83f2cf7d3352a44db6ce36bfc542740f7497ece22a70aaa469d0d69fc012c4df3665b4eb52a3

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe59a8f8.TMP

                                                  Filesize

                                                  59B

                                                  MD5

                                                  2800881c775077e1c4b6e06bf4676de4

                                                  SHA1

                                                  2873631068c8b3b9495638c865915be822442c8b

                                                  SHA256

                                                  226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

                                                  SHA512

                                                  e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  b2309ccdfc5bcffaa5c463070840f9a5

                                                  SHA1

                                                  7567c211ad06da7fb15c3caa55bb6b12197a724c

                                                  SHA256

                                                  2fdb5582273497f3a325df8536fa0562095f840ae6a2815a0b845f54e8d81481

                                                  SHA512

                                                  ac3b170ec5939d49820e2c55e44ca3e4d376367756fa036bf6a14b5f2030386701262b1ddfc4b197e5aeb056537e79aaae96cd5b60806781d79648faac05dd10

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  dd432008c0b44a94c39831aae8ae75c3

                                                  SHA1

                                                  abffe08e3c5b903c99228d443c5b9f68935277d8

                                                  SHA256

                                                  f717b360d0ac105d2c17b5c51467db34152081baf96a96633cbe782fbdf42925

                                                  SHA512

                                                  50213da2880f605e8ab740b1fc7083fe1f4579ec69f5a91048d8577827c2fe89579b432e94b6d4e5151f7070e1a97509432e6762634a19823d04da6e55d82a6b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  5KB

                                                  MD5

                                                  30b4d1b0e917bf0856e4b0f05167d5f8

                                                  SHA1

                                                  34d85f379a72e99691271b8141851198eedaf5c9

                                                  SHA256

                                                  50e3dc7952700bf450629d8b86a377d2566af8ba75a148b773c397638d82e8ea

                                                  SHA512

                                                  075e1b30e4f26b493a16672fbfbaacd53f5b80a3831e5634ba75e3f396c701ee0bd2b0c7807356e12a97d9f79277934b47051e511b95627e26207a02c0e79003

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                  Filesize

                                                  7KB

                                                  MD5

                                                  3816870b39f7dd5857f93226c64620ab

                                                  SHA1

                                                  7bb1ad6bfbf31549c0c626453558349d1c3a8d43

                                                  SHA256

                                                  bdbd9bb40f2d21e0701fa51b44ef568fe4b8a674d058469b21513609d9269fcc

                                                  SHA512

                                                  4a2ec8d3161b2d05a05b3f609583ae1e49ebdccf27b22b2a3535040cc057116a7640b62a099b6383866ac51f7b26996419c95b7a022e4bd1b447591b96f60b0f

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                  Filesize

                                                  24KB

                                                  MD5

                                                  d590b705436b349074c9730516c56716

                                                  SHA1

                                                  545dae2c594f8dd63eebc19fabd55900b7a001cd

                                                  SHA256

                                                  da4e0974a427913f72174b1fa4fc560396d987ed41ed691409916cb42d914413

                                                  SHA512

                                                  e11e7aa45fe3b931bbdf7956379dc61f845e19a087eac8e5ebe4783c5ca3d2a602016271e8f1ea4bd2ef9dacca444b93f1fcab0373921246e2ed7350f48cb9d3

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                  Filesize

                                                  24KB

                                                  MD5

                                                  99315c72c0078122aea1e2e0e41a26e8

                                                  SHA1

                                                  1d04494fd6fd5bc394405c02e23f8df323394d4a

                                                  SHA256

                                                  2dcf01b803332137a3a4925f7fc2878c3c6b8be4be77ef359e7f658811446b97

                                                  SHA512

                                                  7a5404b86f6b5cdddcc12fb9c0f23f4264049ae784faf0be2ff16277eddc09759bcd4f62a6652c87f956255de49f12b12c32dbb5dd228cb99574a963c26ab605

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                                  Filesize

                                                  16B

                                                  MD5

                                                  206702161f94c5cd39fadd03f4014d98

                                                  SHA1

                                                  bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                                  SHA256

                                                  1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                                  SHA512

                                                  0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                  Filesize

                                                  41B

                                                  MD5

                                                  5af87dfd673ba2115e2fcf5cfdb727ab

                                                  SHA1

                                                  d5b5bbf396dc291274584ef71f444f420b6056f1

                                                  SHA256

                                                  f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                  SHA512

                                                  de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                                  Filesize

                                                  16B

                                                  MD5

                                                  46295cac801e5d4857d09837238a6394

                                                  SHA1

                                                  44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                  SHA256

                                                  0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                  SHA512

                                                  8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  c224cd14670e4663db58de1b6c1d7540

                                                  SHA1

                                                  c6cf6efe859eba915847a94c160a8787252db871

                                                  SHA256

                                                  5e6359913fc3c4e22acd59ea428dc1cb71eba92e5f3415bc915e977f128576c0

                                                  SHA512

                                                  63b6eb34c06bf4a8cabea5061c7738ba54de415b6a114fe200d964247d018590e331afabcc9b3469da8feee2ae4529c2f8efcd365527a2ff4c019c8eaf6dc5a3

                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  2071332e0631d2677a9601f778880786

                                                  SHA1

                                                  6f35f7220695fc8f7f051d1358bf00b6adb29da6

                                                  SHA256

                                                  dcbea1ebd34276a76573c3817ddf321d4a87cd718bcf354ef66d757d293e9502

                                                  SHA512

                                                  b400c2775c936140c659a2403cfe8d685b114d30f89367c2e437b7023458a76cc01b94191d2ca5dc34352cb81a0eaacaad6c7874199b9caf00a74859b978adde

                                                • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x

                                                  Filesize

                                                  11KB

                                                  MD5

                                                  1882f3dd051e401349f1af58d55b0a37

                                                  SHA1

                                                  6b0875f9e3164f3a9f21c1ec36748a7243515b47

                                                  SHA256

                                                  3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0

                                                  SHA512

                                                  fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf

                                                • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x

                                                  Filesize

                                                  4KB

                                                  MD5

                                                  214f98cb6a54654a4ca5c456f16aed0a

                                                  SHA1

                                                  2229090d2f6a1814ba648e5b5a5ae26389cba5a0

                                                  SHA256

                                                  45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037

                                                  SHA512

                                                  5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873

                                                • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\x.js

                                                  Filesize

                                                  448B

                                                  MD5

                                                  8eec8704d2a7bc80b95b7460c06f4854

                                                  SHA1

                                                  1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326

                                                  SHA256

                                                  aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596

                                                  SHA512

                                                  e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210

                                                • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\z.zip

                                                  Filesize

                                                  8KB

                                                  MD5

                                                  63ee4412b95d7ad64c54b4ba673470a7

                                                  SHA1

                                                  1cf423c6c2c6299e68e1927305a3057af9b3ce06

                                                  SHA256

                                                  44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268

                                                  SHA512

                                                  7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7

                                                • C:\Users\Admin\AppData\Roaming\MEMZ.exe

                                                  Filesize

                                                  14KB

                                                  MD5

                                                  19dbec50735b5f2a72d4199c4e184960

                                                  SHA1

                                                  6fed7732f7cb6f59743795b2ab154a3676f4c822

                                                  SHA256

                                                  a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d

                                                  SHA512

                                                  aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  5bdb53a1bf3654cc6ca476ca25b1cdfe

                                                  SHA1

                                                  c8bffa49f90c9cd40e131e3e4ee4807717fedbc7

                                                  SHA256

                                                  1b480839a2f0e7ec299a675c87f746c521abb21f5454f3382eab636d1d429391

                                                  SHA512

                                                  e0f9d8e8fb261c994a357fbbd18bb59ff52078225c624cb5b7f4841e7cd13351fb9436d1516c87450fc099171f9f0b13367fc276f3d348f3f6f35ab9ac8697b1

                                                • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms

                                                  Filesize

                                                  3KB

                                                  MD5

                                                  a11033d482fe14bc849b70cdf9e8c83d

                                                  SHA1

                                                  06564da1ae7f6c299a64fb5a2e7f2eb63d335975

                                                  SHA256

                                                  649e250f42fc52f3203cefe6831e188eebb62ab1d13cf14beb7e86d3fdf41dcc

                                                  SHA512

                                                  08107cbde9fca7c99ebd1a3ef52ab971c134cb5d2603475f9d5d75798fd9c9cef2fadb0d9fe3c89913af913c8263284933036d1fa8e09a15f8c5d4ee88029e9e

                                                • C:\note.txt

                                                  Filesize

                                                  218B

                                                  MD5

                                                  afa6955439b8d516721231029fb9ca1b

                                                  SHA1

                                                  087a043cc123c0c0df2ffadcf8e71e3ac86bbae9

                                                  SHA256

                                                  8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270

                                                  SHA512

                                                  5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf