hxxps://github[.]com/pankoza2-pl/malwaredatabase-old/blob/main/PankozaDestructive%202[.]0[.]exe

Analysis

max time kernel
31s
max time network
86s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20250314-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20250314-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
28/03/2025, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/pankoza2-pl/malwaredatabase-old/blob/main/PankozaDestructive%202.0.exe

Score

8^/10

bootkit discovery persistence privilege_escalation upx

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
48	960	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\Control Panel\International\Geo\Nation	PankozaDestructive 2.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000\Control Panel\International\Geo\Nation	wscript.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
3308	PankozaDestructive 2.0.exe
3168	MBRTrash.exe
1932	1.exe
1372	2.exe
4476	3.exe

Modifies system executable filetype association 2 TTPs 16 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	reg.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
47	raw.githubusercontent.com
48	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MBRTrash.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00040000000274c4-316.dat	upx
behavioral1/memory/3308-428-0x0000000000400000-0x00000000004FE000-memory.dmp	upx
behavioral1/memory/3308-450-0x0000000000400000-0x00000000004FE000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PankozaDestructive 2.0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MBRTrash.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133876538683889447"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0093-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0066-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0017-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0097-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0147-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0291-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0193-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.p7c	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2T\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000498C4-0000-0000-C000-000000000046}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3D0FD779-0C2D-4708-A9BA-62F7458A5A53}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5512D11C-5CC6-11CF-8D67-00AA00BDCE1D}\Implemented Categories\{4FED769C-D8DB-44EA-99EA-65135757C156}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\HYPERTRM.EXE	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0102-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0071-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CID\c2441b34-fedf-4e4a-aaa1-c310601feb87\Description	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{909E0AE0-16DC-11CE-9E98-00AA00574A4F}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0074-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0115-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0150-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6F3DD387-5AF2-492B-BDE2-30FF2F451241}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9BE31822-FDAD-461B-AD51-BE1D1C159921}\TypeLib	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0013-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0040-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0067-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0032-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0283-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AutoProxyTypes\Application/x-internet-signup	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020832-0000-0000-C000-000000000046}\DefaultExtension	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4795051A-6429-4D63-BCA0-D706532954AC}\MiscStatus	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8BD21D10-EC42-11CE-9E0D-00AA006002F3}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0002-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0022-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4eb7409a-6062-41b9-a28d-9586036785a6}\InProcServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0119-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0229-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0241-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.docx\Word.Document.12\ShellNew	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020830-0000-0000-C000-000000000046}\DataFormats\GetSet\1	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0002-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.one	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\ActivatableClasses\Package\Microsoft.Windows.NarratorQuickStart_10.0.19041.4239_neutral_neutral_8wekyb3d8bbwe	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ClientCertificateInstall	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00020811-0000-0000-C000-000000000046}\AuxUserType\3	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0027-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0179-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0207-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0220-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{64818D10-4F9B-11CF-86EA-00AA00B929E8}\Verb\0	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0256-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.h\PersistentHandler	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\.vqf	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AcroExch.Document.DC\Shellex\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0096-ABCDEFFEDCBA}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0050-ABCDEFFEDCBC}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0184-ABCDEFFEDCBB}	reg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{41CD4848-693A-46DC-BDD6-19B5E552CFA7}\InProcHandler32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0014-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0014-0000-0000-ABCDEFFEDCBB}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0002-ABCDEFFEDCBA}	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0063-ABCDEFFEDCBC}\InprocServer32	reg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3174447216-2582055397-1659630574-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0018-ABCDEFFEDCBA}	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2776	chrome.exe
2776	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2776	chrome.exe
2776	chrome.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe
Token: SeShutdownPrivilege	2776	chrome.exe
Token: SeCreatePagefilePrivilege	2776	chrome.exe

Suspicious use of FindShellTrayWindow 37 IoCs

pid	Process
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2752	msedge.exe
2752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe
2776	chrome.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3308	PankozaDestructive 2.0.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4092	2776	chrome.exe	80
PID 2776 wrote to memory of 4092	2776	chrome.exe	80
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 4328	2776	chrome.exe	81
PID 2776 wrote to memory of 960	2776	chrome.exe	82
PID 2776 wrote to memory of 960	2776	chrome.exe	82
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83
PID 2776 wrote to memory of 3908	2776	chrome.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/malwaredatabase-old/blob/main/PankozaDestructive%202.0.exe
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=133.0.6943.60 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe565bdcf8,0x7ffe565bdd04,0x7ffe565bdd10
  2⤵
  PID:4092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1972,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=1968 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --field-trial-handle=2236,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  PID:960
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --field-trial-handle=2368,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=2524 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --string-annotations --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5272,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --field-trial-handle=5624,i,8368417657068953544,16805904862705734213,262144 --variations-seed-version=20250313-182214.581000 --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:452

C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\133.0.6943.60\elevation_service.exe"
1⤵
PID:2952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2784

C:\Users\Admin\Downloads\PankozaDestructive 2.0.exe
"C:\Users\Admin\Downloads\PankozaDestructive 2.0.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3308
- C:\Windows\system32\wscript.exe
  "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\D7C3.tmp\D7C4.vbs //Nologo
  2⤵
  - Checks computer location settings
  PID:1696
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\z.cmd" "
    3⤵
    PID:4084
  - - C:\Windows\system32\msg.exe
      msg * your pc was destroyed by PankozaDestructive 2.0
      4⤵
      PID:4836
  - - C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\MBRTrash.exe
      MBRTrash.exe
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:3168
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/channel/UCVTSRzzkAAtUZzX88xoMdhw
      4⤵
      Drops file in Windows directory
      Enumerates system info in registry
      Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      Suspicious use of FindShellTrayWindow
      PID:2752
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x378,0x7ffe4797f208,0x7ffe4797f214,0x7ffe4797f220
        5⤵
        
        PID:5104
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1800,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:3
        5⤵
        
        PID:2392
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1616,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
        5⤵
        
        PID:2108
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=2568,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
        5⤵
        
        PID:4448
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3532,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
        5⤵
        
        PID:1196
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3540,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
        5⤵
        
        PID:4532
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4112,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=4120 /prefetch:1
        5⤵
        
        PID:4460
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --extension-process --renderer-sub-type=extension --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=4136,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
        5⤵
        
        PID:2960
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3600,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
        5⤵
        
        PID:3788
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5268,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
        5⤵
        
        PID:3308
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --field-trial-handle=5460,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:1
        5⤵
        
        PID:816
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5632,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
        5⤵
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,9505915106802614705,7795126174728731901,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\1.exe
      1.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\2.exe
      2.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\3.exe
      3.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4476
  - - C:\Windows\system32\reg.exe
      reg delete hkcr /f
      4⤵
      Modifies system executable filetype association
      Modifies registry class
      PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8451622f-1f9c-494e-a38a-bcfe6e3bce1e.tmp

Filesize
10KB

MD5
886975b6480c933140e61b2ab57c3358

SHA1
44466689e34880dae99a3e9c34b63b136fc6063d

SHA256
2b6b9bd013be25a4afe0641cf35afcef772d3caa56f6620167736128c0fd1dae

SHA512
1c0688ba77c602770805942a772e3beacc5fbcc8ea4a31f388f68c399b0e849292dafcc3d4bf0ada6513be545da9cc7d468e2a561e6ddcda7289ac6f7a987b60

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

Filesize
649B

MD5
8a39571a28c1659e58f03040a16d69b5

SHA1
fdf903741915e6717162e551d5d6966fb3d4e8fa

SHA256
80549c8acbd33134c4a9ab7662cfe1f1ba639f94dc73ff19a5c0ec3d06c090a7

SHA512
758ae245930183750c0e1dd3af42b001bb8a363910aab5c03fe2a492d847e169f7ac03c8873bd3391335addb5248a65f7ba36f72448ac6432dd40add81741b98

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
1KB

MD5
44f01c2ca77d9e72652f3ac82d616ba3

SHA1
b6f6bf9be9f293986fe9b03a9049801d87b8e6dc

SHA256
94be614e836515157a62ffec39bcd90bef675ffb53b9fbb7ebbe2555d1191de2

SHA512
63a05fa915d92709a62d4f0ae9a32fd7a97d262b253b47e087939dbe274d0de30c773c17b56ba24df0b5b0d3e0db6a4fc8f44df1472463bc4f11a4c446a658e6

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
9542ed5c13dd401e20d7e1bb5332139e

SHA1
5e964fa18b6b548e9959eb52fecbb04ed2424b4a

SHA256
abb9687a0deef751d0c62a446afd632c5d4af3832cf1cf05605e063a00f5b6f6

SHA512
e85b651e818bfeacf13078aa2a2a163f1229de4c29cd49f11a3d37aabc24aaab0ca9ca68e2e4289f273f6c840332323064c60aa9b00c065f216a548a4df5855f

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
037a72af023cb8f62df1dd1d6de6570d

SHA1
0307bddf5865923eff9f81ee33d1e94d05834936

SHA256
7e8c908c42b8e6feb98dd0be347cdd1b4100510a8ce51f8f523bfda4e2782a30

SHA512
7cd1dc5fffdad77e7b7eadb3f90a7ec6242243a8e16db139b71fd2c3da6e0365a4187a170fe45c43d79e72d7aa4493eb7f63d51626738fd73b7c1b7c0acd0470

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
10KB

MD5
4fca02856688769ecd565152eabd4e22

SHA1
6593f5d98540b6ff82c53e476aada987a77ffa39

SHA256
c7f2063454128c8eaf499a69125c7462176e03a3ff74e6c60718fa37828c17ae

SHA512
f36dbf4d1acc7325aac6d899b5a333b6a910888f028ea863d51b4acec6fea6d03df48b95a5894f109659fd226983cb92acdb7dc884386fff384cbdd0ed10ca77

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GraphiteDawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
52272cef2b4edd43aa1040fa0e8a5f28

SHA1
3c5baca3f21547aace84105e8312256614d22235

SHA256
cda9e1961ca4efee3faa91dfcf5619d15fdaf336bdeed3e0a71abbca2d14ed35

SHA512
a2247668b04a54b2a5511aac0f478b40888e5ed5c2dfc57968117aa3a1ec5dc39e79c6d3191136f887e8a8aa5fa8cd633ed229f33664f551aa6506a8e34feb36

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
80KB

MD5
7ed24c08acd822c018d0e6ab5de662a8

SHA1
0383368f784cb2249ad111eafaa00ef038e6ba2f

SHA256
4496174874c155ae3d494d5e79e0b23d9a012171c51fe121a7e6893b6572b40b

SHA512
c21ed69f0a4901fe0ea767e3aeca0aaa02d8ebc0cbb17cf27660add2c2adc1ae961e9aa19c96b48d455c3adfee885825718330c12ec214b287ecf5f6ec755377

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
81KB

MD5
d4d4253242515cded2cb7eeb048e9e51

SHA1
8dd705a648236dfefebd3274e24a524acaa9a42e

SHA256
63278dc56e1eef3e61c91efbd7b0a0f60aec72d37e1964c211d8b2453e70aba2

SHA512
9cfacba639143c0ed84fa5ff53ea9ecb4208c7d74699bf0da94a765cd431ae339bd61f0c7d548cf93285813b794f58b0f7a677bed1461c63e01af06bad46a3d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
29f13140c50c2394177caf96baf3a5c0

SHA1
680e35060382a846752eb208b62de077d31fd1eb

SHA256
f4554eb3e1e133edb5f5f01e19539ffc52adc0b346e19c4742a815e7a92b2dcb

SHA512
d964d066a2913d3b6eb73925160d7e9d79a94ae5c6e3956cd361b54fe53833b311990a91346917bc90b227301d864939f6a5a417ff52ef9fe8e21971b1a661fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
a46a324553367dc0b13a007305e4f102

SHA1
005a700ac0bf4429024f9e857e2281f82f370aed

SHA256
a718f2fe90be4422382450b4959840a13d6d18dea09d3da5394624198a126063

SHA512
d3b9fcde15be13451aa441070d9143fc53faa6a2725adea7fb9c340bcb9d7ea183dc1b36c0f8ec21c1748c80bc8fa03a14f198c2fc914c9f8e81702bd8e18399

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
6e0e99c9b92a3d54a53e10a67e11a244

SHA1
09bad487f4681cd3906e8cf2b81a4e2e85f552e7

SHA256
553c5021872d43de34d6e129a9129cdb9abd76eaa40378edbd33adfaeba2bf85

SHA512
9eaccb2ad896f600161d38c8eff437b87418ccf53f444edb426269a076ebf5945bd30778260cd59d42aa564c6027bf4e66ad07ce123a8d4d440e12f2b23d42eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
014f920c37e2201c22dbac148ed53f75

SHA1
a8b9909cfef2dc1a0596706eaaf5eeacda78d391

SHA256
87a11fb0d55316ab815ae96539556e017d32fabc1025c60c19733d6fefc5f662

SHA512
e2c0ce768b2b93e4c780f7334a6b285322e434ad04dff34ae1d0acf88fb3da9df90c30f0db1bb0b8011270ad22299c909bcd19aad7b2684a46d37efb1b6562e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58124b.TMP

Filesize
3KB

MD5
3822164ae0e1466875f179b2ec65088b

SHA1
6b7eaf28b0929277522c5d886f5413ccfc4f2e9b

SHA256
845e14107bbb79e29d24302f5ae35d2dc0f7d773950dbab125139bcb2a1ce16b

SHA512
3d3bf9ea31cb3d679f909c3da909fd79e127a00fcda68f767ebaf6f05a85c54a6f6d68ff67e6922737cf5e6c8c3cf58d7f685a9cfe165d2bf8ae061f558a6963

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

Filesize
69KB

MD5
164a788f50529fc93a6077e50675c617

SHA1
c53f6cd0531fd98d6abbd2a9e5fbb4319b221f48

SHA256
b305e470fb9f8b69a8cd53b5a8ffb88538c9f6a9c7c2c194a226e8f6c9b53c17

SHA512
ec7d173b55283f3e59a468a0037921dc4e1bf3fab1c693330b9d8e5826273c917b374c4b802f3234bbb5e5e210d55e52351426867e0eb8c9f6fba1a053cb05d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
3KB

MD5
9d8daa7a0aa671a8920c5c693aa69b5c

SHA1
cd22eee0bdac15c94457dd863ec11234767b9c84

SHA256
e1d1d1e435c33a559b494794abfda19b9d3f7f28b6478fa359180ed0ee63f0f9

SHA512
093b9556799adb5bca7827f1142d3e0fca81eb90dae7fc3a307164cf744ce4821eebfb6f55efa370d1f3fc9bfd0fd5eea60d3d1752ed38602081be106c9fdddd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
bb39f697a2d735427a8ef2157db30600

SHA1
fcb7aa5c8b4f2c71b49c92b7b2c1a3817239d92e

SHA256
7902c5ae7ffd41d4fc97ac70f50d5162df889cc570b2b44a50b38234b3056030

SHA512
e8f40e9d3a014c685ded4a04f248417a158d56f95109839ad3636863ee56e8e6bfbae68cf3837e6a17591655d73d7fe6bb884253d473ef6b2af40304a1a4bbb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
6f0f7261e23d9b999d5c78d42f3e3d57

SHA1
4f4a28f41baa33d326ca6096bd666ffffdbd8071

SHA256
c221726505c7af2bfefb9b7ab70987595b8e62316297a4ea1c17599efa9b4e4d

SHA512
874a1c162f4c014a0af3a6929c3ab4d7869bff5c785288503b318b8f249a702c0eb88138563bd2a7e968743358ca14c0bfe16252d98992a77d5c26dfb66bfc4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
31KB

MD5
f2f1fd0238f70e698bc0af1974c2b1a6

SHA1
85158794e5907f1a4a2f5604d8c7532ecf0cc43a

SHA256
3011315f6808a9a2918c121f9c571df98c22a72ba39f4ee221b91d4ddfdf911a

SHA512
a25326b6bb89515ec2465edd8a8f483ceebd7122f0bb74685dbfb7dbad204c66b791c82ba208c746f0c2ada6ff616f491dee1dd33be5766bd143034e41a661b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
17KB

MD5
2b60be51252d7a86d2bdc9be9c4b4cf1

SHA1
34c95bedfc75062d0169350b5e9a7508a8b16950

SHA256
68a298b118001e665e1633d0e1ff3b23056538636937363045c136529f5ae07a

SHA512
11c29a80ebc225391131662f12ff4f2be7379e29fb5e05b04d1ed4b94f4749d7064d6dd4fc53be816904c246ddfdbb000c09e92300a5ef8b5e5fd3a2f5f188f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
7KB

MD5
56692071965a4eb073fe675893910505

SHA1
70d6151ee8e79540824fb7a07108b1740aaefbcc

SHA256
2d75976b04ba2726604d7e0a18bb5e37d53a3a803c947a8b8f1a2333b975018f

SHA512
e8c2a78db70a3226398068774f9ee081ce4f02dd067a1e349ba182e6b956007a111cb3ce7362af18942e9611299d1addb90ca55aa58f1422e9d29762065a9609

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
71b5e6d742fde3a603b52c2cd092c93f

SHA1
becb8ebcc5007beb52237663724d2ec8ff41f648

SHA256
5457b9ac7bb5b3f6ae48a95bc1ba07158b4dfd78a9cec5db3648eb11342be104

SHA512
e36ff1edeada85989388c8e97fc62879c138547b9573031748d9404cae669438326facb5bd60f985b1e1c4e9d1d01c8b90a569907306847f27d9d4749ebf3afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
6KB

MD5
1803d45b59250358e9218ed2ff3f88c0

SHA1
21a70278d362a1e5a601f610a4eefc021d294547

SHA256
75cedb4e71b68fcd3b5416d0a31f6d2597d08a63fb9e31f662a08df83c0f4b35

SHA512
1810c8d067404a6ef19a649dc6743b3071c5569061fb9c0a12848c0156e945cd76c017c832aef549f3aa0ff4055adfb86735afed955f63b236dcaa3b35169968

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\1.exe

Filesize
105KB

MD5
e3ad0fce5b7affbd427c44dbccf3a2a6

SHA1
20d123432852d8a0d0ddb8e7508fe0f57885d111

SHA256
c5518cf71337856ba8e39dabde1130a846d25a90f8ac6935e772cd38fdd628cc

SHA512
68f2fbab56eed7ca082a63b71a4faff132c7cca8ffc5f072d6a4003190dcb1d212bdeaa2aa618d3c29eb91c10bc706edd278cae37d5a1f057c32591569ae62fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\2.exe

Filesize
103KB

MD5
84a2c1994a66f68ea0de1ca54f2daf8d

SHA1
6ac5d9893549810063a7f3a4c11e3acfe7fff198

SHA256
a3f537d75fe7bee34ef70c0997c4dd003f1b463d6ccb5fcdb996a78a41f851d5

SHA512
43697a8813138e8d72678810842594b1669000683a5224ca274fff4c905717ae61d8c4300f8480bb56105dbc827b8c9fcedc10e1d0a7697a8bd92c72cdd6a769

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\3.exe

Filesize
49KB

MD5
6cefab6016b44454e094b35bc84bd948

SHA1
0413ea19c49c7572e5b5ed53d057442f1763bea2

SHA256
b7edad47d3eaff2ab66e6f25ddac676e86bbb477c54ed83aefefc8cad65d694f

SHA512
f55316fa5fdcbc489e36bbd778ab6ffabafabfcd0e5575327e07649a1549b6758859dba4e91fa3350b90de9da28b5af740a7914d58265e2ec49509423564e9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\D7C3.tmp\D7C4.vbs

Filesize
510B

MD5
109768b34b00dcb845bbe2e6b232f907

SHA1
01936f9faba2274ab97d23e150c4ae4be13a1e6c

SHA256
db25a503c58209a43df5f7af4bea2ad62943b00ad5ec70abc9223f5d6436456d

SHA512
f9b7dcc291f8e6d99f7e3fbbcc7589e5c8c4d3d883b543b7e30959b7b38be39287f26cfb5d4f34689bcc92a11572e689d7edd7fef09e4bf1b06776596aa62099

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\MBRTrash.exe

Filesize
1.3MB

MD5
1f7e6f09dd9e7c40ddf8993d73bbad0d

SHA1
e671e3225623efda87d61e025b20c791d8f4973c

SHA256
734f955f5cd99a47cd6e500efd96cf5e5aa4d420cda4f9ef170d6b1fa3eafefe

SHA512
e8c2046be890aa84a02a19a2f04c8d3546121f978895e286950b9091363f4c2a3d144314db2cc529a8a99333895590e3b786ed41264cbc1d7840aa770c152005

Download Submit
C:\Users\Admin\AppData\Local\Temp\D7C2.tmp\z.cmd

Filesize
208B

MD5
4b4ea7740ea13b18e73d9f958ea775cc

SHA1
27bae1aa5cd752bd52b8fa014360faa7153eb3b8

SHA256
58de6c1e7bcf4ce71aebbca0ddf2c81efde4f67a2a89fa8eb7d8e009e029f892

SHA512
444c4d8dff6b36013b621d3e06bb936bf3b7fe0d96ad72cda66c6216f10b8e0640832e50177a195d264212c8b79beec170b69d52db3be5f1bac651a5a0b954fd

Download Submit
C:\Users\Admin\Downloads\PankozaDestructive 2.0.exe

Filesize
734KB

MD5
b172b2bcebd8e4797ceaf0503c5840ae

SHA1
ecaec7910a01b4a142741a0ff0d49c0a47acdfd1

SHA256
86b279800d7aa3025b59391f4f8bab2039c41258d0daf3d85365b0c3ddf05065

SHA512
f1e2a996be71155e1a101ad5e28c826ef61baaa4d5bb5a003b7038531e647d02438a4b82f67ab26d96c0b6af412b7e0b45b2568a8325beb1b90b81fb4266947a

Download Submit
memory/1372-735-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1372-744-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1372-643-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1372-741-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1372-738-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1932-642-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/3168-454-0x0000000000400000-0x00000000004D8000-memory.dmp

Filesize
864KB

Download
memory/3308-428-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/3308-450-0x0000000000400000-0x00000000004FE000-memory.dmp

Filesize
1016KB

Download
memory/4476-644-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download