killmbr | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo

Resubmissions

15/02/2026, 00:53

260215-a8trksfw7b10

11/02/2026, 00:39

260211-azvmhsdx7b10

Analysis

user interaction
yes
max time kernel
273s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/02/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Da2dalus/The-MALWARE-Repo
Sample260211-azvmhsdx7b

Score

10^/10

bootkit defense_evasion discovery execution killmbr wannacry impact persistence ransomware spyware stealer trojan wiper worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x0002000000023788-501.dat	family_killmbr

KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr
Killmbr family
killmbr
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Downloads MZ/PE file 22 IoCs

flow	pid	Process
62	2648	chrome.exe
62	2648	chrome.exe
62	2648	chrome.exe
62	2648	chrome.exe
62	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe
63	2648	chrome.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD1835.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD183C.tmp	WannaCry.exe

Executes dropped EXE 15 IoCs

pid	Process
4620	MEMZ.exe
872	MEMZ.exe
2412	MEMZ.exe
2480	MEMZ.exe
2504	MEMZ.exe
2092	MEMZ.exe
3660	MEMZ.exe
2804	WannaCry.exe
1652	WannaCry.exe
2660	!WannaDecryptor!.exe
5656	!WannaDecryptor!.exe
4904	!WannaDecryptor!.exe
4876	!WannaDecryptor!.exe
2040	PCToaster.exe
1296	TaskILL.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1196	takeown.exe
3420	takeown.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
164	raw.githubusercontent.com
61	raw.githubusercontent.com
62	raw.githubusercontent.com
63	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 26 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\A:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\N:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\Z:	mountvol.exe
File opened (read-only)	\??\D:	WannaCry.exe
File opened (read-only)	\??\E:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\B:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\F:	WannaCry.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_714104771\data.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1044042665\content_new.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1572168888\arbitration_metadata.txt	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1572168888\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_714104771\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1044042665\content.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1044042665\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1044042665\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1300803332\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1300803332\typosquatting_list.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 24 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCToaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2556	msedge.exe
2648	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 5 IoCs

defense_evasion

pid	Process
3376	taskkill.exe
4560	taskkill.exe
4816	taskkill.exe
6816	taskkill.exe
5688	taskkill.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134152439888393950"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-914486190-3969805341-592249730-1000\{B90402D7-27F0-42A8-A814-3F47BDAE7656}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
872	MEMZ.exe
872	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
2480	MEMZ.exe
2480	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
2480	MEMZ.exe
2480	MEMZ.exe
2504	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
2092	MEMZ.exe
2092	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
2092	MEMZ.exe
2412	MEMZ.exe
2092	MEMZ.exe
2412	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
2480	MEMZ.exe
2480	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
2092	MEMZ.exe
2092	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
2480	MEMZ.exe
2480	MEMZ.exe
2092	MEMZ.exe
2092	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
872	MEMZ.exe
872	MEMZ.exe
2504	MEMZ.exe
2504	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe
Token: SeShutdownPrivilege	5956	chrome.exe
Token: SeCreatePagefilePrivilege	5956	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
4560	msedge.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of SendNotifyMessage 44 IoCs

pid	Process
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe
5956	chrome.exe

Suspicious use of SetWindowsHookEx 19 IoCs

pid	Process
4620	MEMZ.exe
872	MEMZ.exe
2412	MEMZ.exe
2480	MEMZ.exe
2504	MEMZ.exe
2092	MEMZ.exe
3660	MEMZ.exe
2660	!WannaDecryptor!.exe
2660	!WannaDecryptor!.exe
5656	!WannaDecryptor!.exe
5656	!WannaDecryptor!.exe
4904	!WannaDecryptor!.exe
4904	!WannaDecryptor!.exe
4876	!WannaDecryptor!.exe
4876	!WannaDecryptor!.exe
776	javaw.exe
776	javaw.exe
776	javaw.exe
776	javaw.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 1628	5956	chrome.exe	87
PID 5956 wrote to memory of 4860	5956	chrome.exe	88
PID 5956 wrote to memory of 4860	5956	chrome.exe	88
PID 5956 wrote to memory of 2648	5956	chrome.exe	89
PID 5956 wrote to memory of 4992	5956	chrome.exe	90
PID 5956 wrote to memory of 4992	5956	chrome.exe	90
PID 5956 wrote to memory of 2980	5956	chrome.exe	92
PID 5956 wrote to memory of 2980	5956	chrome.exe	92
PID 5956 wrote to memory of 5668	5956	chrome.exe	93
PID 5956 wrote to memory of 5668	5956	chrome.exe	93
PID 5956 wrote to memory of 3120	5956	chrome.exe	94
PID 5956 wrote to memory of 3120	5956	chrome.exe	94
PID 5956 wrote to memory of 5776	5956	chrome.exe	103
PID 5956 wrote to memory of 4068	5956	chrome.exe	113
PID 5956 wrote to memory of 892	5956	chrome.exe	114
PID 5956 wrote to memory of 5436	5956	chrome.exe	115
PID 5956 wrote to memory of 2368	5956	chrome.exe	124
PID 5956 wrote to memory of 2344	5956	chrome.exe	125
PID 5956 wrote to memory of 4816	5956	chrome.exe	126
PID 5956 wrote to memory of 4620	5956	chrome.exe	127
PID 4620 wrote to memory of 872	4620	MEMZ.exe	130
PID 4620 wrote to memory of 2412	4620	MEMZ.exe	131
PID 4620 wrote to memory of 2480	4620	MEMZ.exe	132
PID 4620 wrote to memory of 2504	4620	MEMZ.exe	133
PID 4620 wrote to memory of 2092	4620	MEMZ.exe	134
PID 4620 wrote to memory of 3660	4620	MEMZ.exe	135
PID 3660 wrote to memory of 1788	3660	MEMZ.exe	136
PID 5956 wrote to memory of 2804	5956	chrome.exe	137
PID 2804 wrote to memory of 2064	2804	WannaCry.exe	138
PID 2064 wrote to memory of 4504	2064	cmd.exe	140
PID 2804 wrote to memory of 2660	2804	WannaCry.exe	143
PID 2804 wrote to memory of 5688	2804	WannaCry.exe	144
PID 2804 wrote to memory of 4816	2804	WannaCry.exe	145
PID 2804 wrote to memory of 4560	2804	WannaCry.exe	147
PID 2804 wrote to memory of 3376	2804	WannaCry.exe	149
PID 2804 wrote to memory of 5656	2804	WannaCry.exe	155
PID 2804 wrote to memory of 5964	2804	WannaCry.exe	156
PID 5964 wrote to memory of 4904	5964	cmd.exe	158
PID 5956 wrote to memory of 5580	5956	chrome.exe	159
PID 2804 wrote to memory of 4876	2804	WannaCry.exe	160
PID 4904 wrote to memory of 4884	4904	!WannaDecryptor!.exe	161
PID 4884 wrote to memory of 368	4884	cmd.exe	163
PID 3660 wrote to memory of 5720	3660	MEMZ.exe	168
PID 5720 wrote to memory of 4560	5720	msedge.exe	169
PID 4560 wrote to memory of 5804	4560	msedge.exe	170
PID 4560 wrote to memory of 2556	4560	msedge.exe	171
PID 4560 wrote to memory of 1580	4560	msedge.exe	172
PID 4560 wrote to memory of 1580	4560	msedge.exe	172
PID 4560 wrote to memory of 1580	4560	msedge.exe	172
PID 4560 wrote to memory of 4748	4560	msedge.exe	173
PID 4560 wrote to memory of 4748	4560	msedge.exe	173
PID 4560 wrote to memory of 3832	4560	msedge.exe	175
PID 4560 wrote to memory of 3832	4560	msedge.exe	175
PID 4560 wrote to memory of 3832	4560	msedge.exe	175
PID 4560 wrote to memory of 4972	4560	msedge.exe	176
PID 4560 wrote to memory of 4972	4560	msedge.exe	176
PID 4560 wrote to memory of 4972	4560	msedge.exe	176
PID 4560 wrote to memory of 5168	4560	msedge.exe	180
PID 4560 wrote to memory of 5168	4560	msedge.exe	180
PID 4560 wrote to memory of 5168	4560	msedge.exe	180
PID 5956 wrote to memory of 3700	5956	chrome.exe	182
PID 5956 wrote to memory of 4676	5956	chrome.exe	183
PID 3660 wrote to memory of 4972	3660	MEMZ.exe	184
PID 4972 wrote to memory of 3976	4972	msedge.exe	185

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
4532	attrib.exe

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffec1acc728,0x7ffec1acc734,0x7ffec1acc740
  2⤵
  PID:1628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1276,i,17999712635543915394,9899068379767861624,262144 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1576,i,14222705975465868147,7085848562295277599,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:2648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,3701843711110140347,1441224800267085689,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3204,i,16182020432500981982,18267076047261958702,2097152 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3208,i,8814135540060204774,9024917237713547001,2097152 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4416,i,11396467031028356285,12927647573034870832,2097152 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4436 /prefetch:2
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5244,i,14655648851379761815,8405894226815107862,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5812,i,508012525696023807,6046851490947974911,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5760,i,13443546661341563485,2760819062482953879,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,13246990735098794728,820956351615165215,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:5436
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6028,i,6508912450337449226,3592669836499295613,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6120,i,5230993976109216875,10015457005031407483,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6116,i,5046345478758039458,7843158550317426374,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4816
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:872
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2412
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2480
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2504
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:2092
- - C:\Users\Admin\Downloads\MEMZ.exe
    "C:\Users\Admin\Downloads\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5720
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:4560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7ffeb0f3c188,0x7ffeb0f3c194,0x7ffeb0f3c1a0
        6⤵
        
        PID:5804
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,10875281170426885739,7696411064393210731,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,16597162335543095276,11593634974594966751,262144 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
        6⤵
        
        PID:1580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,17649406321601605870,16988165637693315145,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
        6⤵
        
        PID:4748
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,15371157761838750230,4780789454151364070,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
        6⤵
        
        PID:3832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,9444838070085959981,18294050142767734357,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        6⤵
        
        PID:4972
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,6549479860256303031,14094713685215571769,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
        6⤵
        
        PID:5168
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5148,i,13021575707815961457,15318191287472114051,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
        6⤵
        
        PID:3776
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5348,i,16791825873288523118,9627062652124545990,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
        6⤵
        
        PID:2552
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5119490444858651762,15218867377362811329,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
        6⤵
        
        PID:5912
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,4955508723233869919,7438422933909599102,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
        6⤵
        
        PID:5144
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,7427852932422633430,8157595961807451370,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
        6⤵
        
        PID:4852
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4900,i,13099987354025055493,13905765340046339838,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
        6⤵
        
        PID:5836
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5656,i,1882294802963895026,7846409168665364550,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
        6⤵
        
        PID:6112
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,3631048614954742633,221957395758802869,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
        6⤵
        
        PID:1072
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,2605599457976520402,5463307007093521454,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
        6⤵
        
        PID:4372
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3909161416338876611,10155150190528950882,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
        6⤵
        
        PID:4548
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,3909161416338876611,10155150190528950882,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
        6⤵
        
        PID:5884
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,15631514625015007077,12229288449864717554,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
        6⤵
        
        PID:1612
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,15526622105161782785,5271319659850040273,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
        6⤵
        
        PID:1712
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6972,i,2767150236022118995,14488632494914000489,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:8
        6⤵
        
        PID:5204
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,3067866485989695149,4403694474980333039,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
        6⤵
        
        PID:6344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6624,i,12547694270853457055,368898364152970600,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
        6⤵
        
        PID:6640
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6960,i,13263725826349378686,16517026761887062585,2097152 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=7096 /prefetch:1
        6⤵
        
        PID:6708
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,6653943738994345904,17894084035360179023,524288 --field-trial-handle=2304,i,13693690347089093694,634443770857755212,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
        6⤵
        
        PID:6180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4972
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
        5⤵
        
        PID:3976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      4⤵
      PID:3560
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
        5⤵
        
        PID:2100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
      4⤵
      PID:6604
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+remove+memz+trojan+virus
        5⤵
        
        PID:6616
- C:\Users\Admin\Downloads\WannaCry.exe
  "C:\Users\Admin\Downloads\WannaCry.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2804
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c 173771770770490.bat
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2064
  - - C:\Windows\SysWOW64\cscript.exe
      cscript //nologo c.vbs
      4⤵
      System Location Discovery: System Language Discovery
      PID:4504
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe f
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2660
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im MSExchange*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5688
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im Microsoft.Exchange.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlserver.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4560
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im sqlwriter.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:3376
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe c
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5656
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c start /b !WannaDecryptor!.exe v
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5964
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe v
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4904
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4884
      - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:368
- - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
    !WannaDecryptor!.exe
    3⤵
    - Executes dropped EXE
    - Sets desktop wallpaper using registry
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6132,i,3049495248627798923,15246229384897540798,262144 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4084,i,10514156846632676871,3030083198971834922,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3700
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Offiz.js"
  2⤵
  PID:4676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5852,i,2142637784475543118,1171683570965664928,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4212
- C:\Users\Admin\Downloads\PCToaster.exe
  "C:\Users\Admin\Downloads\PCToaster.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2040
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:776
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h C:\Users\Admin\Downloads\scr.txt
      4⤵
      Views/modifies file attributes
      PID:4532
  - - C:\Windows\SYSTEM32\diskpart.exe
      diskpart /s C:\Users\Admin\Downloads\scr.txt
      4⤵
      PID:5256
  - - C:\Windows\SYSTEM32\takeown.exe
      takeown /f V:\Boot /r
      4⤵
      Modifies file permissions
      Enumerates connected drives
      PID:1196
  - - C:\Windows\SYSTEM32\takeown.exe
      takeown /f V:\Recovery /r
      4⤵
      Modifies file permissions
      Enumerates connected drives
      PID:3420
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /im lsass.exe /f
      4⤵
      Kills process with taskkill
      PID:6816
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol A: /d
      4⤵
      Enumerates connected drives
      PID:6276
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol B: /d
      4⤵
      Enumerates connected drives
      PID:3604
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol D: /d
      4⤵
      PID:4344
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol E: /d
      4⤵
      Enumerates connected drives
      PID:6348
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol F: /d
      4⤵
      PID:6460
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol G: /d
      4⤵
      Enumerates connected drives
      PID:1180
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol H: /d
      4⤵
      Enumerates connected drives
      PID:6536
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol I: /d
      4⤵
      Enumerates connected drives
      PID:6580
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol J: /d
      4⤵
      Enumerates connected drives
      PID:6616
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol K: /d
      4⤵
      Enumerates connected drives
      PID:5912
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol L: /d
      4⤵
      Enumerates connected drives
      PID:6112
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol M: /d
      4⤵
      Enumerates connected drives
      PID:3900
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol N: /d
      4⤵
      Enumerates connected drives
      PID:6916
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol O: /d
      4⤵
      Enumerates connected drives
      PID:736
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol P: /d
      4⤵
      Enumerates connected drives
      PID:6808
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol Q: /d
      4⤵
      Enumerates connected drives
      PID:7096
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol R: /d
      4⤵
      Enumerates connected drives
      PID:7120
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol S: /d
      4⤵
      Enumerates connected drives
      PID:7072
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol T: /d
      4⤵
      Enumerates connected drives
      PID:5360
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol U: /d
      4⤵
      Enumerates connected drives
      PID:7008
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol V: /d
      4⤵
      PID:4360
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol W: /d
      4⤵
      Enumerates connected drives
      PID:5432
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol X: /d
      4⤵
      Enumerates connected drives
      PID:372
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol Y: /d
      4⤵
      Enumerates connected drives
      PID:2140
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol Z: /d
      4⤵
      Enumerates connected drives
      PID:6308
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol C: /d
      4⤵
      PID:5992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,3673831247359428283,4408427835170881654,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1528,i,15729415752884736372,11656588270739862190,524288 --field-trial-handle=1960,i,11557116632302864883,14824591105742036516,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:6224
- C:\Users\Admin\Downloads\TaskILL.exe
  "C:\Users\Admin\Downloads\TaskILL.exe"
  2⤵
  - Executes dropped EXE
  PID:1296
- - C:\Windows\SYSTEM32\mountvol.exe
    mountvol c:\ /d
    3⤵
    PID:3812

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5784

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe" /r
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5180

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2344

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1300803332\manifest.json
Size 118B
SHA256 48881283d466df5c80ae4d408642256cb046703c73bac3e0d1a40753caf44fe9
MD5 3f3d37e34470f0c1a980557812682b24
SHA1 01a0d684455ca5623d1780e184f915d7fd647cdf
SHA512 5608da5d68346e97c2c352ce6caf4010c4ca2116a1159a54d15ccb09ef900b9c46df16d3391461a05e6d307ce0b1d466d513635e920f24fd93392229c52fe6ce
TLSH
T137B092B00C1AA43B22C1D320ECB0A68283F80218E8022B1E08C036481F8827884362B3
MD5 SHA1 SHA512 TLSH

Submit Download

arbitration_metadata.txt

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1572168888\arbitration_metadata.txt
Size 343KB
SHA256 07d3423beb505d69a9ed17c71e96a88509c41117e6ab9d6014cffe81c46fe7c2
MD5 6b8740e0662b67555214c91c8781268b
SHA1 606536ad8540063e58d34c86b1aa226e80aaaf1c
SHA512 46022d1ca0ff6cc25e93b8b65355993cf774a9297dc6262b992eef18e530ded6b6941d0be830cff76fcd355d7d375ec6cb4ffb34a756273de8b63a103fd5448c
SSDEEP 3072:uuGUDP7IjAyFyc2hKN1YbxGTz5Yv2zfbzLsXpi7:uuBDDI0yFyc2hKN1YbxGTziv2zfbz37
TLSH
T1A674C863C5833A58ED589E107EEC3E87253539C210B20A92EF8B6C465B41F8765F71EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4560_1572168888\manifest.json
Size 238B
SHA256 1bdda4a8fc3e2b965fbb52c9b23a9a34871bc345abfb332a87ea878f4472efbd
MD5 15b69964f6f79654cbf54953aad0513f
SHA1 013fb9737790b034195cdeddaa620049484c53a7
SHA512 7eeee58e06bba59b1ef874436035202416079617b7953593abf6d9af42a55088ab37f45fdee394166344f0186c0cb7092f55ed201c213737bb5d5318e9f47908
TLSH
T178D0A727EC008DB611B207580AF5A742E3B1630F7C012509377308CC0F3D1744081285
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping4560_714104771\manifest.json
Size 52B
SHA256 dcedd46fab398b40ecea0160d44a5140286672ecd6e70b7d63a675de3e0030e6
MD5 4100dc4a7cbcbfb95078f35006d88b85
SHA1 5ade230ac8f36d89b8ff3db7d7ed94175313b460
SHA512 ed02ff06ab9d94e287da52d034ff547094f073cb7e969f532840e0e8b91896f80e826264fd33b3a4bbe9c73fd085d4541265eebd11d56c83e21e8cdeea911708
TLSH
T11D900260042495571AC10E906574F8959391661A55850D1E0445154802D546CE050298
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 0c71e27c683b821e526c7e22c14fb91a1dc7e564772df7c38cac3813bfcc32c7
MD5 3cc0657565258934ee0fa9d110f1a49f
SHA1 7622a63b9409dd57f3b860275469e46a9c75fde1
SHA512 7e11c1f28dc98e5f35b29e8c86c466e1f8c77a12ea5729362f03ff2dc8da6315b75623931ce4a9d40a44c13ae0f00eeea196126a746d04c4286d19456a502bda
TLSH
T1F2F0F4A6C921FC6B18FD1B1960A40B4AEB5113272B41995F3A3D860C8FB463B868A91C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 586e21a6c7e81ec239b383cc3d6091a87dcaf9539e7d9f930f9396f8cf19456b
MD5 56af0fe59eb3d693118e026fc40d085e
SHA1 31c2448134934b2b4daa0d86f74843a1f7947337
SHA512 b31d98fdc69c2a0445a3a999478f33c7f87bceade747b9c4758d73f3453f7dd0dbbaf8d9e44974dbd47aad4cae5a3c229a902605951f350a7a5db6480377e8ea
TLSH
T1C951C7DBD4CC245BEB86017094E0680272BDD225005FDE3A5AA4EEFF6992FD6D231980
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9dcd538e9820fce61f9629c60796d6f6e3388ae6357facca1e13420a3b01a342
MD5 f3d51d4192656899787c8163fa469333
SHA1 10bf237b65b850c84ea4cce3fa969cdd6bd68ef3
SHA512 1de6bab1166a31284d0809ef25feb1d63bbd30ec4e50992adf1f02a43eb0e6e431cb487c2ab5e3e2f4fcecba37c9ab8880039ffc7ff5871770ae491597288144
SSDEEP 96:D0yE+Xj5Jgw7cpimDmYHZg1mVpumgmO+mtmMI:D0yE6j5JgwopimDmYHi1mXumgmzmtmv
TLSH
T16491BFF383E49A7D8A0195F4AB14AF1FCE690514531C3C6AC8E4AE0B93E2972E24074F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9b18cef80104204bee17c551a5743ab2a028d9895d77a3a28176c44493464289
MD5 bd7f1c763a40bf288938b61c36c64dc2
SHA1 931b87a5e13bba63fd3be086cefb3013032704b5
SHA512 878e54db6b6e007158e67d3d4e5d9cb16d874ea7d3e100fbf639c329765e76a95378a956740e5fb89f851547aafe2d7e570430f10e45be889233bad708a7c558
SSDEEP 96:D0yE+Xj5Jgw7cpim5HmPmVpnmDZgBmtmO+mBI:D0yE6j5Jgwopim5HmPmXnmDiBmtmzma
TLSH
T18591AFF783E49A7D8A0195F4EB14AF1FCE690514531C3C6AC9E4AE0B93E2976E24074F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 daf0f5b33d35ab0f81cb97bc6ac421c96c650e9f3af8c20bc08fb273572efb07
MD5 8e3d0d624856a9f052473c20dfb3729d
SHA1 b43c994a8ba7a5364124ffcc101124b53a3a2783
SHA512 ed4e5af5644b09a1d2e85f1cddb8105d1e992fd0344ba8415a01a2c664ed56ce09c37d66b0f9af3aaea811a2f620aeaa363ab7d574bccb8099db5df29c037a90
SSDEEP 192:KR5PezAQspv7japAPRp2noT9mHsb+WNnaK2hRenAsS5kwoDRVyIsnAUge:KR5PdpaUXvIwn+eAHm3e
TLSH
T1B242C82EA914757F5CCBD219FAA67B57EBF5102160841E8CEAFC8D2C00E76CD6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d8a0f6ccf5bb571f00da01ab1e65d45ba335ff7d06b731f9d49b36af9d13caf3
MD5 560068126f0f0fab81a50cc4148ffa32
SHA1 dbdb598d956adf4bd0204ab99284a7dfd9eed3df
SHA512 aa5a72c4cc3b6c52b8e838fa7791efe4d63308a2a33cb717cbe3da1c5efad7495c0d65d008bf5315432b3c1e7bb22ec3b6efbea0f6b969a9d0000209b94e9f2e
SSDEEP 192:KR5yezAQspv7japtPRpNnoT9mHsb+WNnaK25dy2AsS5kwooRVyIsnAUgE:KR5ydpazXoIwnyy/H/3E
TLSH
T11F52D72EA914757B5CCAD219FAA67F57EBF4102160941E8CEAFC8E2C01EB6CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 13c4e7dbf7a8baa714e8785e1cb06e98db6c598e8d1e28ca073f324d3c807c7d
MD5 06298ade2e620e235c52bd1cd66731ee
SHA1 e3cc3dfce3c42c8647147904c128d73436cb80fe
SHA512 db89472c5058488353540c56677b309d6a87899cb588fe144e4aa8f14cedc69f3a0c0bdbe1aee643b91992302ec4f8b23280914dea7ef90045bee0727a856f9c
SSDEEP 192:KR5/ezAQslv7japAPRp2noT9mHsb+WNnaK2ua2uAsS5kwoDRVyIsnAUge:KR5/dVaUXvIwna2XHm3e
TLSH
T1E242C82EA914747F5CCBD219FAA67B57EBF5102160941E8CEAFC8D2C00DB6CD6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 658d855405cbad2135a8b09c0daac888ceeab8112a7cb7cf62041894b5be5d21
MD5 2a3d3d60077f5aff9850330c7a5c6d45
SHA1 8f1ab2b6c962845313778ec589d16538ff6e5305
SHA512 550ee1f8317defab99f7613f3718939b9bd0a33804693968698ec1567113fa68083a1584c8c3f6d5898ba265117b5a62228b4d3fff6bc0de4141f3e41059e519
SSDEEP 192:KR5sezAQspv7japtPRpNnoT9mHsb+WNnaK2jLmkAsS5kwooRVyIsnAUgE:KR5sdpazXoIwn6m5H/3E
TLSH
T1EB52C72EA914757B5CCBD219FAA67F57EBF4102160901E8CEAFC8E2C01EB6CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 96e7267fe66d9b2aa85665eae2704a149e2ccbb844c55611d012189579eb486f
MD5 2999c9119e893f219fd005fa761986a4
SHA1 2668ef9c5ca09a59da49b68799c37bc308611579
SHA512 2df81b1928e9c48c6e466a00260e1e9118e97d266593afa4161d1990d1a1d3fd0a60a62827a639d561f9f97024551ffb35d8eeffcf86da836d69fcd5a55d6227
SSDEEP 192:KR5uezAQspv7japAPRp2noT9mHsb+WNnaK2+Sg1AsS5kwoqRVyIsnAUgE:KR5udpaUXvIwnOgKHr3E
TLSH
T16342D82EA914747F5CCAD21DFAA67B57EBF5102160841E8CEAFC8E2C01E76CD6227417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 18cc0e8cbef29a1bf6587e49cd36fd63bedfc31b03fb8eb4c27c733ccde56bd5
MD5 2adc72e2c8bfa9ab998ab8904cc0fd6b
SHA1 712b3248305e9e7721be388b2eb4007717f2c170
SHA512 6a99524b37d68192819058a79336df851cc21e6f240682706e594c021963ec90ad089dfbc706e25b227bc09776229e150d5caf9b99d750d2b342141ef566d491
SSDEEP 192:KR5DezAQspv7japtPRpNnoT9mHsb+WNnaK2A0U7AsS5kwooRVyIsnAUgE:KR5DdpazXoIwn6UEH/3E
TLSH
T14452D72EA914757B5CCAD21DFAA67F57EBF4102160901E8CEAFC8E2C01EB6CD6217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 d2a1c211543346d6d7fa73eb1a15ebd6120e15ab69efc0af8ce3a2ffbcef5ad6
MD5 a4be69182142ebc71ae9eebeb6cc0bac
SHA1 cc4fdec699beb6bf0844e884934569f910c07ff9
SHA512 e9566753d0c71c3cb0519f7448ac2f413f0270eb8fe1c8b246da44c179f872c61363adfa463ba478ac5e853747e57629567fff3574ed4b3f5273ecf45c908f45
SSDEEP 192:KR5dezAQspv7japtPRpNnoT9mHsb+WNnaK2QOOrAsS5kwooRVyIsnAUgE:KR5ddpazXoIwncOUH/3E
TLSH
T14A52C62EA914757B5CCAD219FAA67F57EBF4102160901E8CEAFC8E2C01EB6CD2217417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
MD5 6932e737f9fb5bb798f741f34796b7e1
SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
TLSH
T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 2ef9c854a12d34c4b3aa79d443627dc773b6a0f25393e5cf41a2cfc44ab5329f
MD5 8d4020c2cbd211e03c6b8c25d5e61e91
SHA1 37f0327c34aa7c614bfcd8957302246d82b35adc
SHA512 c0fa1e507c9b7269274184bdbadbcb4ce1d5320e0f064b0e0eba2464f274775f886c8ef1026dbccb2cd9912897090414918b3cc135b9509191bb473643b9c744
TLSH
T19DB0125180019695C10702F51183448831149F10C705270353F07E7298271908028151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b234.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b234.TMP
Size 96B
SHA256 11af3ab3e4d97c1f0fa6c3e39a4df8b1e3bff8c7f16ccd40dc761513e979101b
MD5 b3c3998d128b03cc342e1e72cb5615b0
SHA1 5e68e6c037c3e40340c93ba068d68f889fb84ac8
SHA512 66c7660e4eaf0acbf74df0017c8bb33de5befa863dfcffbaab192be899ac6f39f421f31e4498e00b20ee775e82886a25c7a58797bc9413e33a2f5e468bb62f42
TLSH
T13EB00256C1437712C44603B92999D5DAB2B0DF29C603171692E06E6EDC29A70992A962
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 cead789698a9431ac6082fb5305e0979de47e4ebfd858015e82a9d685a3b6da0
MD5 ade41adfc5530f1ee8dcd13ff11ba182
SHA1 031ab1ef570534f5e32d99a25bc0680cce396f2e
SHA512 6c6604aea062b5d0efe6bd03bdb3603376bda53317c881b59b287e12643ff196319c6da7031f94205b5bda56ad8811534b275b09165841876969c214b8f44cf7
SSDEEP 1536:0RCaBcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0jB3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1E69302BA8E1A49E799BE0681769E7809CD17130E709FB8CC7168538C21D01CD2BB3E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 f3b4302e1343f42edc5ee90cc139ce5c126012b849975e82ee130e720304b676
MD5 299db2ee8636a3bef91a04008c52bf2b
SHA1 5baed6da1c98b175c30fded7bdb6ef713bd1c5b5
SHA512 fa524db3ce9f9114552203f07b3ab716bd4190c10ab80f7e290355ef125f47a4c6e05e9021c17323cd953d4699b8760cdd7a1d2b767ce971cbb02d43771d2af3
SSDEEP 1536:0cC1UcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0m3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1BE9312BA9E2A46E7997E4691729E780ECE13130D709FA9CC725C538C21D41C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 90KB
SHA256 5c98c47ce4ffaa730e1e97860aab3f0adb366531935c9c9d93a9d1f9d91d4c87
MD5 b37c6f0a13126f1ec348f313200ac40a
SHA1 b931792123fb42b6d993b6871cc6580cfa7d867f
SHA512 6dc3639c769ad81e7cd2bbafb901ec15acd8d332ddc73d56feed263051d0bda244f9101a0c26add07b8f0340b24d847a3747d1a3ffedbaf894a7868b1211aa1b
SSDEEP 1536:0xC1UcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0h3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1189312BA9E2A46E7997E4691729E7809CE13130D709FA9CC725C538C21D41C92B73F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 91KB
SHA256 fa28b2e9e90636b11f4c072dd0bb37bf65ff38309022e25f316ad3b85b6f9877
MD5 1b5ec73c4c452c0fca1ad81507ce05cb
SHA1 0d961f073d987cd523664ece6ac6f945ac72b342
SHA512 0756a5e4b6a79da4d62eb6425c491a6e55964d18f677a1f52c6a8ae394beee119060f09b4586df678dfea6c16ce64164532bbf92b6c0d4f692b0d0265fe6421d
SSDEEP 1536:0xCaBcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9e:0DB3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T1949302BA9E1A49E799BE1681769E7809CD17130E709FB8CC7158538C21D41CD2B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 129e6394fc50a24659b67a5b877dbedb0519270f2f3671a7322736c8400dcfd7
MD5 e9a13c577bf9966d5655f439a8624622
SHA1 bd8f957f7db4754823be76ad3bb427ecc01ab822
SHA512 604df37f3f413236e571e1b7263840f7fc7ac2ff858137e58b52d9c70b6aeff9e42938a4b2509094a77624c26a4e1d2dbd122f61bfc5f76159b0e5dc061776b3
SSDEEP 1536:0cC/cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0j3Qw/xLANk0mUW5GmRntSFCjEENW
TLSH
T14E9302BA9E2646E7957E468176AE780CCE13130D709FA9CC715C639C21D42C92B73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

first_party_sets.db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\first_party_sets.db
Size 48KB
SHA256 0c2a7d9a05ecc2cc77765a0a5d71529f2237755fe60ac3d742d6c07805f80d14
MD5 e045e65cd8ef3d083617318874fb79ea
SHA1 c2fa643f68ddf8df9e99d41cecc7525e5a2c08c3
SHA512 23c380211a66716c26bb85d47c8d82531cd1ed92636bb91e281a4abb9e2e2123967e8b4761d830c99c8fabdd7d6e7526165d78111e0ffae97194ce7a1195dcb6
SSDEEP 24:TL74/arHRH34kQrq+i7ZYZY5J+Qnj3k0rJXAeL3mkAD6W6Ivrr6UwgfL:TY/IHRH34kWqB1kQnjhHmr6ITmU9L
TLSH
T1C223886EDA2CB9A1FEE40B3DD7D1D0127735AA0EC2E4D9F1099B406746C540405EB63E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b1e4ba6890ec60cfe9f6942acc1937ba6fdde042b45c0a2e0b7e13ade701cfd
MD5 642961cbd4f67f82b3038bc1275d24c3
SHA1 f1df4ba11ac13409c392147b2a9da411bc9cd6eb
SHA512 4f7f98f2ebf15c98a7f379a7975f6dff1c7086a1e3cf81d3daec8c9be6212ba05fb4eefc5fa2c0486a277860dc8b2aecdded5e174409117a0736b1cd3b8443d0
TLSH
T1CCD0805C52B3BC75D4C7997045C53B47373ED493659187317C6274B90C534504D961C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d68b8059d1fdfd8541892ccb136bddd7ec7601b55110e2cdd4c0e5ace97d9da8
MD5 531be76c0b4d3ce6131509c7d95980da
SHA1 8d06c8ade4d281ea8e43a1dd0a469db76987e5cf
SHA512 3f61844b74b97a902b9307c088590e72b7ad0e95c0f14948ae3780aa3e04b871d8e5c5cb6ca5f5fdf524ad8258178623c85c528a35deec8559c2d1d114436d1f
TLSH
T125D0C05C12B3BC35D4CB987004C13B03323ED893659187307C2234B80C0304048960C3
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 116d6b4b778245f352f13d9fed304846746e09a50aa12ebfba2177ca151a7e64
MD5 48d037eefeabccb09453b2a197eeefee
SHA1 c362fd89203f125d1d659d22a75d60e52ece9047
SHA512 d6a3750126aaadd6d398266ef44dad44cc0a5756b214e07addac37c35c13ccb80f9c574380fd00c08fb97bbb507df8ed8205f0b54c4f1b53d8b7a02e3057fd82
TLSH
T11DF02DB9C925FC771CFD171960A44B4AE75413572A809D4F3B3C820C8FB1A3B869585C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 356KB
SHA256 460505560ab2247563b98ae4595bf51905c962160178528eec74958db5d3cd0c
MD5 566c89152516969b66652a120f3e2671
SHA1 b76dc5648edd9aaff67d4b5282d05b4ecc7c2426
SHA512 7fcbee4d2ce9019adcf1583bf72fd186d712554c8edc76737d34b2c7ff3a739dabf433c9ee314cc106228c84567dd9be77d4178630d7d5733da23d518a39bbe8
SSDEEP 6144:2q9ufGFxJYxPcgECQjDyymJcxtinzJPMvkJnyfaV9Cr+olD0WW5UBa/xgqBwk:2ISPcmQj2EonzlxV9Cq20mQ5guwk
TLSH
T16074231A70E39A4CA29BC69B9D4A413205CBF113856706A123DB7C3F7A456DF90BBDB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 41KB
SHA256 78c01e0ffc9c58a8d74d8deb125fe24300d4308b80a542fc8da544926c603cd2
MD5 a906c8209bcb1e15c8ae38e45f659f69
SHA1 14ff034bbefb62426ee96b8ea80650b2d15db4e9
SHA512 85732f3c7706a9a28dacb20966a509c7d1cbbdb883743a4d0fc84a5c3041aee6b5169c3ea77142dd4efba6830875f2930450c4c2d3ed5e56c072e806fbd92068
SSDEEP 768:X3rQmoJR2QQ6vMjlP2ENDa7qxAsbkTYMJGpWH36CvOVy3UAESl1y7Q:X7boJdQ4xENPx7kYiGWX6x4tEYUQ
TLSH
T16A13F15C0D1697E0E31326A34EA5578CC394E1CD25A5FFE7CE1768CB016A6B08C90BDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 39KB
SHA256 20b535fa80c8189e3b87d1803038389960203a886d502bc2ef1857affc2f38d2
MD5 9a01b69183a9604ab3a439e388b30501
SHA1 8ed1d59003d0dbe6360481017b44665153665fbe
SHA512 0e6795255b6eea00b5403fd7e3b904d52776d49ac63a31c2778361262883697943aedcb29feee85694ba6f19eaa34dddb9a5bfe7118f4a25b4757e92c331feca
SSDEEP 768:Vce3jkow68wmT4IBX0tXdlSirS61gSjcz0GPwHbP+w2jec56O:VcI/iEEEtXdFJj+0GPwHbP+w5rO
TLSH
T13703023A5E3CCF1A84157A703950F6D9A8481E548E9D143B4F1AC7BF085DDE2209B6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2df4e56415df10d3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2df4e56415df10d3_0
Size 289B
SHA256 fe9e48b9d705fb64fca0efc0a380eacb4c01afa347887da54680c125acc8de33
MD5 111a4d77ece30021f730ff52d0a3d972
SHA1 2c80e287e8111b35e87678ee29fb62544d405f98
SHA512 5efd0bee8bc839a3c683b1b1d8d09b8e6f8a0a373906c2f1cf84e700cfb8a63a00123f77aa831e9742cc5f9ffb1091954cecb53027e3deb932649577febafa5f
TLSH
T126D02BD792682445CD05C9F0D6B773CADA1741E4586CD0D743219BA763489F39994580
MD5 SHA1 SHA512 TLSH

Submit Download

d7471dc36235272a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d7471dc36235272a_0
Size 804KB
SHA256 bbf4b0a4b8e632d464038df6f8ed16acc2bb9a760086b60135bbf526b36014cb
MD5 d0a57d270be6d1bf6d0cafa631388186
SHA1 cabe0a70cdc05cb78e19c28067e8bf5b4de92277
SHA512 e0639b7a4bf4bf3bb86b3df9c4784b62921cb57ac5a74111b9befdb8fac6018fcb33ea3c37b62355fdfc932f1c035fc507be27c7456cfdbbbb9311d84b086b6e
SSDEEP 24576:LTH8izM5jPzLtF1inNvY7d5DpjD1W8sFaz/5AB9qa6P/fBNlNt77LVFTvHUD33/+:oLOPx3o
TLSH
T1E2050771DB81FEADC66662F689229D19B97911CD4D96B90323A0CB7C38C81D44FE3C87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 9f95af78ae39f04034d78ee6a62e0fa34ec7c55fdd096e56e34cf1f38b4d186d
MD5 d91db088476dbb33ce8cbdb1c7958d87
SHA1 7fbece303ddfa00768268a8bf3dcf8a779c482fb
SHA512 5cc37a0573d7692de56d6889469315dc7bbb9cfaf0bd0544b9230bc9917c33efe832bcf80df219d8e5b3205eb37897f918e48220aea0a3a4ecb03ab5e3945a68
TLSH
T1F9510D05E08EDB1FFBE90D3455D7681C7E748798144A6F0A3DF18C7DAEE23A2119C41A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 7b72d667386f0fe815b381984d0dc0be2ce40e98f691de8341bb9de00dd288b9
MD5 f0f624d1ce10b3fe1dbb6b95e62637fa
SHA1 c049d3276366e4f1403bb7ace0d2d5c87246272d
SHA512 2fc573b7bcab9eb4f930f9adbaa49c50d11832632e5f6d963be4b0f87098a74b0cf8453b636b84a3c79f33f0dcda014f9b1220c164a05f9306ac0ebf7ab0df90
TLSH
T1AF410D04E586DB1FFBE50D3495E6202C7E748798140A6F063DF14C7DAEE2712114C81A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 fa9c63ceb820097ce93c65ada679f768549f0284cd47bf862f21a502e87dbbb4
MD5 0590e2de8035fdd5f76ae5018e7340b9
SHA1 36a75015c48727dfa6fc9f3bf20bba9a05f728b3
SHA512 70b0e4f7c51aaae6d36b3e11ea03f40ef91f425d0aaf0b7d11465f74d92bd76bfe6b75616e46d2296b4aeb5b8a70353b9be199004f263bdcbd630893a9a54a97
TLSH
T15E510D05E189DB1FFBE90D3455E7681C7F748798144A6F063DF18C7DAEE2392119C41A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 105KB
SHA256 a3e0ed3b7b22eb63f8d684039026c6d1cf309dea226c1060864a6dde8ef4297c
MD5 35ae3b10ff09df4a55dc35b6a13e7f7a
SHA1 fe687665d50274195c09df8c0da43a3281143963
SHA512 6e0f0955ecc244ee48e49a902266addd795478331bd0f0865b92d66a08f660efe55cd0ca570f6116b5ba85970c359854e921faf3b517b566cbdc2ec1c6e7719b
SSDEEP 1536:IEpH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:rHSRhPjU1
TLSH
T172B35227D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 512029f0182507478cf82271adecdffd4e3a2458ef04c480fa8cc5de3fc2c77d
MD5 fbaeaf117d9bb20a64e56aaf6edcca7d
SHA1 817bfab0a2e32514e50adb1a2a4575ba873269c8
SHA512 157503b599a3773040a0f8df74f20e6d3663b7f3f30ba0d531349096af87398682c57749a293b7d7347c071c3f1ea933999b3e7ff297e466fefea4734bd932fc
SSDEEP 96:DGtaclTbPBdBA1IXI0y/XGwBj6A/W4pUEpeEc:DGta8Tb5bMVXPGkj6AeqU2ef
TLSH
T12781DAF3C3E8852D8E0195F8AB186F2BCE690625931C3D9A84E4EE1BD3E3871E10555F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ddb23083f0a4a6563fa0896ddd0452b9101a4b0d6df5b28cb9b9c7482f938d4e
MD5 dc8d68841b2b749a4731f47af58c3cef
SHA1 06d0996ea440d7eb8936c64a5286fb429f882425
SHA512 9d7254b630ef1af68ff81032a78512f80cdaa997772cdaa5fa2a71c8c235d4f0d9c2a5b39147ae4bcfb3649b2b10d66824f22ecde4b67803a945daba7d20a766
SSDEEP 192:sxZBRTyMqZ/K1Ml8sjj/fpsxfaZBrfnAzodp68HW6+WNHPF/YxPheIGZIgVfpJ:sxZB4Lj/fpsxa3rfnjrHbd/779T
TLSH
T1DC72E915AA38997B8DDBD209FA857F53D7F9056391504E489AFCCA0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b5342ecdfc43e25bc922cbecf66295f57411b701d7ad794fdca83325a5af1e69
MD5 0fa8c4c8da5e73c76423149040e4a64a
SHA1 ff093f34e1b17c7c839a108f5fe759b40682de79
SHA512 55aa96460d551c8ee93a83c3d7a464b1d34b36aa903a70bec0af6240b6d92e0afffdd432fa16595f403ff010cc8abbdec35991c4aca74431aabda206e2ea1f9a
SSDEEP 192:sxZRRTyMqZ/K1Ml8sjj/fpsafdQWJAuAzodppg8HW6+WNHPF+sW1fYMRYLheIGZu:sxZR4Lj/fpsEdRAujHHbdGfpj7ST
TLSH
T1F972D816AA3899BB8DD7D209F645BF57D7F9046391504E489AFCCA0C00E7AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 c3fc22a4613cf28b0eeaf37524cad118a05a520e1b732249e948a22996d3a171
MD5 362a17376c5723bf00058622ee192ba6
SHA1 6a0c0bfbba21ca2598c9eb51f74c62b017aace1d
SHA512 63c1973444b5eef5cadc9c57721790f01758b244eab841a55b0498c2d9129078df7ee413ddc6dcfd1b3e728eee46e29803d4afead49a7e71f00a461670569dc8
SSDEEP 768:Jic+tU27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5DFkLlMeNtFroW:Jic+tUWE/VRWvV/qHu1ja8DFkLO6t+G9
TLSH
T170F21B3B2C0CCB7E4F840E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 379e1e5fcb80892519bac901ab116e475c1863b77e6ce25b414966fb841522ef
MD5 bc7ce9ddcbca4744d72b3494af8d3564
SHA1 b19916c40c19b804fe44b0c5f64c500fa8f09416
SHA512 0c42d4410c252c35d13e032ff75c4f4a3afe2ab9ca0baec84356618fe7c8e826ddc4b9f05b638ae53734c712aeb2f9a2efbe95a7ba48ec2c9ce71c616cbd782c
SSDEEP 768:Jdc+tU27pLuL/VRWvV/qH8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5DFkLlMeNtFroC:Jdc+tUWE/VRWvV/qHu1ja8DFkLO6t+je
TLSH
T1B9F21B3B6C0CCB7E4F840E9CEC2A7E9E6EE401CB96988D5447F9885C02C66EB55171DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 27KB
SHA256 c2209f1386e26d776fdf6d04e7d2711b5e2307f5a6452a14b7c83cabba00f13a
MD5 b29d41a0f386cb26b85574c153728290
SHA1 02918481f580f029e58e134e6ec9b324c4dff72e
SHA512 835df4cd02a662a25d5bbb33725fc6f3a65701ee6d4056db8c902cddba38461b506e202aa661ef00d95ea662e67733c4c10c2bee3252cc06b66afe96e75b23b5
SSDEEP 768:SXEpUTaFkzG/T1ddEtgjzzLlRQbz4BD30LK4xf6vsr6c:SXEpUTaFlz0LK4xf6vsr6c
TLSH
T169C24F10313B02813A7E699D95A5B86F62C270733058B83B7BB904A54F6BE10DDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.0\data.txt
Size 143KB
SHA256 4edfdb9cade0be665696dea609332ae299080986e7adee23432a7012f107851f
MD5 695d1e0603e2d8d001b7b604580bba26
SHA1 796e01101b9596a88c2e12ed2b7406d874df7c43
SHA512 91865dc3f65a7c722207fa8e1e442fb637c49b9d0160e885b58fd4afb2cdcddf0f8ca516c6a1d9aafa00ff8ce5b5a91f122f46dcba264e35753b8daf39d3749e
SSDEEP 3072:0PAgDcCHaLHl65aynyosxb3+B1xh0OrlwYEnGA3iqS5Wt8y:YX1aI5aZoKzMJ07NnGk1
TLSH
T1E5E3F150CA841F9CDFAC261C50FE0F1DB3D0C79D852B658AEB63BE4A6F4AA0457274C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.4.0\data.txt.WCRY
Size 143KB
SHA256 86bdf18e3abe1a6a89cef0ea08c1ae14d2a4393d3b82b6023d97d2c223367633
MD5 b98edb74add9bf84c271960e0136aaab
SHA1 cc2dbb5c094296823149f441fd6a0cea4f588ff6
SHA512 540a6c5753cb50ccb75f035f4c12c6bb230b601fcf768fb227eaf3c1913b9be2bc5846d6a141d48e98785e73dc6e355bf6dc68ba05c7272449f098bebaa7c806
SSDEEP 3072:83rnUvD4VeVZmoMAy017/4m+pZFFPeWCMgv7Js+al41B6uI:83rIDsx/cZQmSPFmJMI7JDMP
TLSH
T160E312AC325623EA1CFE8EA931B487E729EE631646DD2DB314EDB551505FA0383188F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

arbitration_metadata.txt.WCRY

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Notifications\0.0.0.46\arbitration_metadata.txt.WCRY
Size 343KB
SHA256 5c6fa9f2e5bacc0aca39bdd744fb2652565b25fb6fe554d6d19025ab18995088
MD5 6101e10be2a481a566f83f22fd09daea
SHA1 c47e66054bd389c2ac565e2c6c763f4990c09d42
SHA512 c368701bb01dd98a4afa9b48d290aa3bcec780fb6b4b95e15b9f458936b765ff71047125c166044e5de86d1ef8a7ccc98224f20e32db0eb5775e6be0e2b1e33b
SSDEEP 6144:zSILsXtqPlI7kw/hSifxYRr4HHiwla0wCHjpiZCZR7N0ci8:zSILe+lskyZ+r4HCw8JCKMFN0w
TLSH
T1DC74234CF1AF097E7C6FD1E30DDF44A0AC1C0995AA461A1E186704DB70F4A33B9867BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bf1e5642e817d502451778b51d545f587801977941e91bcb59d804534eeb2b89
MD5 9811a48bb65467c6d9bfc91f5030e227
SHA1 5e7ebce27b2688ce065fe90f3a4743ab38c187d4
SHA512 e3577845392ff97caa613d319cfa380bc826d15da55f663475a07a0cd2eec6298c91f2ca48eb961c137216c9e84417ec95be5662adf1e8ccb8bcd19aeb37a281
SSDEEP 384:ngiFavqMg3sNg8TUNTUlIm29JCGvRvfEPWTSTy/inEdnS4mtmuNrNlk+5vI+D:7Fayv3PwgJqPWTiyGEdS4smuZf
TLSH
T120C24B75EC98DABBECE78F89E7497A57DEE011A7D58C4AC4CAD81D0E009719E1307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3ef068ee3f0cad685359e43964adf95c55b4354a67696efe068e02cf9961dcdf
MD5 d6ecd64bfbd2a82c8b87c43c51786ac7
SHA1 8bab6e60e71abe35ff43070915ff6ea4474722fb
SHA512 7eceaeab5767ceb7efbac3b4b9c6a9c9c200154be4edaf627d847697ce2b5a8b2549da1d54ce4dbc3f6759ac88e5fd19c2bcca6a14102cae3c7e64e363feeb52
SSDEEP 384:n7iFavqMd3sNU8TUNTUlI4b9J+P1dP2RvfEPWTSTy/icuoK5t/0OF4rNlk+5vI+P:WFayO3Twgd1JHPWTiyDkb0nL
TLSH
T11BB24B72E898C9ABECD78BD5E7497A07DEE04293D98C8AD8D5DC5D0D00970DD130BC52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 cdbe9bb4e92cae11a4edeafcaa7ceb23e06d629e8803d77ed6b10c498a85314b
MD5 ccafc27041355835fb2ffa4e36fb535c
SHA1 42cdfc0e2e4d9120196840844c1ec44c9c68cb3c
SHA512 fdf5107796b6343b88760e772af813d376e04b44567be7417605ca870999c6e8a2bed3011c4b5c5907d66b7f75324935203ea72b4d00735a3a3c263d8f14a7af
SSDEEP 384:naiFavqMk3sNU8TUNTUlI4b9JnK1duRvfEPWTSTy/icuoK5t/0OF4rNlk+5vI+P:RFayb3Twgf1xPWTiyDkb0nL
TLSH
T13FB24A72E898CAABECD78BD5E7493A47DEE04293D98C8AD8D5DC5D0D009B0DE130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 714d014055d457d4c4b6d5cf5a99b0e3e97450a99f778d9946ec1456ad05dd00
MD5 706c6d608fc65ecf21c2b7ba04c7aa59
SHA1 737dee7a038547b53f1f2af8e3dcceae52004d7b
SHA512 05ae4305e445ff826f8601039b82c7c9d5e1050cdc6d367da2ca17e6cd173af7a0b19f520bd280e2c13f3be02eda1d97a4f0879d3c3e7028fefef5543cf3c722
SSDEEP 384:ngiFavqM/93sNU8TUNTUlI4J9JW+1diRvfEPWTSTy/icuoK5tT0q2yMrNlk+5vIk:7Fayy3Twgs1tPWTiyDkv0QEv
TLSH
T116C24A72E898DDABACD68B85E7497A03DEE05293C68C4AD8D9DC5D0D00DB0DD530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cf4852462f0feb6305ddafcd6181d84b932abc1c3cca46dc8dd8b4ab92b0ed01
MD5 33a148e00278c8c3604364780e552956
SHA1 db176fd0cad992f0c399c884b673d7910fe6e39b
SHA512 a6174107d0137d77ea1bd5089bb63bf8b543c972a8f5ca8d48fec4b978e7e57be505b5ffabc35ac7f3e70f8209b3def32fc99c97c27e2909904f91c01376d3fc
SSDEEP 384:n7iFavqME3sNU8TUNTUlI4J9JSw1diRvfEPWTSTy/icuoK5th0OF4rNlk+5vI+P:WFay33TwgK1tPWTiyDk10nL
TLSH
T1DCC24A72E898DAABACD78BD5E7497A07DEE04293C98C8AD8D5DC5D0D00DB0DE130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 6864ae844990f20ad50283346c4619b4e4ab75b3d2ce492bb4ef0bae690432bc
MD5 ae39edf125a22314473cb57d1f1f870e
SHA1 e445121f8ea2a626e5acbd13057e4c3ed97fb521
SHA512 69a25a166dd30ad3217070f0a18c6e813978f968a6c6dc0aa88ad3d12290dcee9f011c13dc8ed7c237ee9d587b9f335cb0ce0e24b8ccada5d428dfd1d6592e60
SSDEEP 384:ngiFavqM/83sNU8TUNTUlI4J9JWw1diRvfEPWTSTy/icuoK5tT0q2yMrNlk+5vIk:7Fayv3Twgi1tPWTiyDkv0QEv
TLSH
T19EC24A72E898DEABECD68B85E7497A03DEE05293CA8C4AD8D9DC5D0D00DB0DD130BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 74d578914b425ebe06ff5b4e31c2700ed8bbf071757fe97f0cf818d73cd640a2
MD5 a566d89ee4b6125a5f503c9056b7c396
SHA1 5206781eee67fec82b974d5183e2d544b9e40a67
SHA512 18fa6c470ba381c0988d931ec0216d5df1162c0d029617fc13a36ad86a474bb3dac952033853db73cdc6a9fef6fbe679297237bad4f7259becb05488143f922e
SSDEEP 384:ngiFCvqM/D3sNU8TUNTUlI419JzT1dyRvfgPWTSTy/icuoK5tT0q2yMrNlk+5vIk:7FCy43TwgG1JPWTiyDkv0QEv
TLSH
T14EC24A72E898DEABACD78B85E7097A03DEE05293CA8C4AD8D5DC5D0D00DB0DD530BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typosquatting_list.pb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Typosquatting\2026.2.10.1\typosquatting_list.pb
Size 1.4MB
SHA256 fd7845f94bff1f5a5b06223a1bb308b29ba52b46a49dd2fbdadc8c797af029e6
MD5 aa5f1bc0c63ec0fa1c9dfb6ee62a7855
SHA1 9e89f00652d25adb582eda27a6af433f14f8e36c
SHA512 fd9642140f1b3a3871cffe6778c5baabd7fa859dc7092b8afd2ae646460bf3492c09e937b0f37fe2228400ec3563b9eb9f9e2d6764900a31d7318147d87a9ed1
SSDEEP 12288:7KQP64uBXFDT0d3koQTFGxjT8cwagWNRbuvWJ0RXLde1:JPcAdQTFGCcwa9TSvWP
TLSH
T14165A4B9DFC00185DBB8112D20BF71D8181412A180E9DFEAFE7C85DF2B8598977E49E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d66c7c80938248300906322a0955b670b7627aee67c06ea033e7dd3fa460210e
MD5 ac70be3159c694b9d8971dafc2979600
SHA1 cc839e1e624073b0356887b2568e5a760681f856
SHA512 1d4dbd6091f4a8b0ad849287d64457d3c9f2819f1ace41ce90a5cf49f4c038ea7337b8c80df8104f3ae1125594c2a91918b18f01008390cb97a849ca4bd52c30
TLSH
T173C02BF41C5D01C2E9CB088F0EC8087402A5CEC0002013FCB49B94263C3E10C80E392F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f7ba236bf2c5026b53ed9d8f34d0fc0be29f3cd5a0823369b24a3fffeb3b9cc9
MD5 3ec1813ab01a8f5b06714217b8df8db9
SHA1 a1f8637f8d741e169efdda694a4c601a15b0c887
SHA512 f278413d95754c78351e6d06a12d5ba1c56fcc8ad127508fbefda181d111576f10912c27ec101888c8e7c848739ef2eea9b6553b3b508a91ca5f4d353b909787
TLSH
T10B41D458AAF91148B3B76E5A9BF6986E487FB8772E06D49E00110E4E0A62E40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4560_1248743351\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

!Please Read Me!.txt

Path C:\Users\Admin\Downloads\!Please Read Me!.txt
Size 797B
SHA256 227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0
MD5 afa18cf4aa2660392111763fb93a8c3d
SHA1 c219a3654a5f41ce535a09f2a188a464c3f5baf5
SHA512 4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b
TLSH
T1DC01F12EAD5572115BB2C572357DA197EA02925F022E0352B907C13917BC13655FE4F1
MD5 SHA1 SHA512 TLSH

Submit Download

!WannaDecryptor!.exe.lnk

Path C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk
Size 590B
SHA256 260899f70a30160e18d49a9a11ac80f46d09e0c278fcfdc0a8cc6f52c99955f2
MD5 71c5e466a9756dff38d4872433276aa0
SHA1 8fa5e2e5bad55d5b1fa30658f0a2a21919b55dbb
SHA512 d1e65867110049c04614237a63f6a028b42044f31425ef1310350eb33efd366ff5f5741474239ed780202c622c230ba81791ffe4366bef0ac3c51be93f9eaa24
TLSH
T148F09E940ED76E5BE423413A0337831ACEB0BC04B215BE1E8594971C95B18051745D5B
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 7fb477d3dacfe4ac664a03f2979f86e532e473e709aaa2d1b8a5d6bb52d61224
MD5 2244e29dcbf8104d373af01c587fc047
SHA1 4b5ec516b2c5908ed915142dbd965179280bba26
SHA512 04a04e69d9fdb6e5d50950319cb05dd01dba382ee0c09d0fd8103e36a9cf29b98cab4e08cf92d9d7494b7fab1748619b9d3c840b6935ef667763f0bc4ec0cc91
TLSH
T152C004030C000C17C0350137D0CC43C105714DCC0D40F3501D0414D510114D315511FC
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 83adae847b150b4461cd9be12f4990df5be87cbf9809cd7e0235c452ccd96d47
MD5 2ed643d081123a700fca20afde18308d
SHA1 228f49add9c09ca96ecc802fb28edc41fdfaff0b
SHA512 aacbb38c43caff9586274a002232614dc17f0e1a07cd5f5589c564d46ade5cfa18c4ad3de47985c4dfedc67ed6127e3309f0685525ebadb62dd30845bd3bc7d0
TLSH
T1EBC004031C000C17D0754137D0CC434105714DCC0D00F3501D0414D510514D315511FC
MD5 SHA1 SHA512 TLSH

Submit Download

00000000.res

Path C:\Users\Admin\Downloads\00000000.res
Size 136B
SHA256 ff7ec7befedae372469290450a0363351153edc39e871f0f3ff996f90a895a41
MD5 fab3fb12ae6953649047aa8ea7f15c8a
SHA1 aa7ae40554b2e30656b7127364ddf6f6fa1d8189
SHA512 ca141d34add2f8618fd37a4a17e957baa2638c7fbb343d9026c5066b32c4d48fc633e3aeec066bf0c021d0ca2147c6e63f360672d74383411e24a1a45300719c
MD5 SHA1 SHA512

Submit Download

173771770770490.bat

Path C:\Users\Admin\Downloads\173771770770490.bat
Size 318B
SHA256 4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44
MD5 a261428b490a45438c0d55781a9c6e75
SHA1 e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e
SHA512 304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40
TLSH
T16CE0861D7588F57512435242C93EA1EC91D55C925702AE18DFB7ED54A6005BC096E003
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Offiz.js

Path C:\Users\Admin\Downloads\Offiz.js
Size 2KB
SHA256 d0806a3f935b9ca64041102958975f4b66d9cedd843b1f48bdc9e38d2f559bba
MD5 3ff1855e571558f709d7b69f1fef3e1e
SHA1 ae26203998506ff223ecd7b5f82c945a5f5e7d77
SHA512 85773239ad953810796789d60436caff5d98dd2ccd5db0e00e362835c327756653b4fc1de67648a11d8a36972d384a69cffcec06fe078e9e252e1494d672e2a0
TLSH
T16D51468CB5A16046842A6A754BEBB61473F09003A254D841BB6CC5E0DFB42BFBB15D4C
MD5 SHA1 SHA512 TLSH

Submit Download

TaskILL.exe

Path C:\Users\Admin\Downloads\TaskILL.exe
Size 31KB
SHA256 4663715548c70eec7e9cbf272171493d47a75d2652e38cca870412ea9e749fe9
MD5 c261c6e3332d0d515c910bbf3b93aab3
SHA1 ff730b6b2726240df4b2f0db96c424c464c65c17
SHA512 a93bd7b1d809493917e0999d4030cb53ab7789c65f6b87e1bbac27bd8b3ad2aeb92dec0a69369c04541f5572a78f04d8dfba900624cf5bd82d7558f24d0a8e26
SSDEEP 768:Tyc7/ovNV004AjWU3GQelVUlidf+prtbjzjy1QVIibtYcFOKc6K:Tyc2z0ajWTQelzdGDbjzKQVIi7OKcl
TLSH
T1EFE21A74D3C31170D28EDE72A6B39BB94B37561B2A5B316E390DA3031EA2184479732F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 560497.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 560497.crdownload
Size 411KB
SHA256 85a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3
MD5 04251a49a240dbf60975ac262fc6aeb7
SHA1 e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0
SHA512 3422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2
SSDEEP 3072:quJFS5Aqu+WwjxeI/0gVnfKl0FA+aPobO24yNz88iu8vDYHTlI5EJD5Hbibfd6PK:/JM0mCsWq1/qpz+nF5c
TLSH
T14A946082EA1681E8F82B72F1669D3CC418A25C9D94C6D61FB1B735109933783DD7BA0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 937484.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 937484.crdownload
Size 224KB
SHA256 be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
MD5 5c7fb0927db37372da25f270708103a2
SHA1 120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA512 a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP 3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ
TLSH
T1A024015A7A61877FD0B20532746194FB4EFE0DD3F5A89A4FE74D0A501F048884BE3A9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 99963.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 99963.crdownload
Size 183KB
SHA256 b15c7cf9097195fb5426d4028fd2f6352325400beb1e32431395393910e0b10a
MD5 3d4e3f149f3d0cdfe76bf8b235742c97
SHA1 0e0e34b5fd8c15547ca98027e49b1dcf37146d95
SHA512 8c9d2a506135431adcfd35446b69b20fe12f39c0694f1464c534a6bf01ebc5f815c948783508e06b14ff4cc33f44e220122bf2a42d2e97afa646b714a88addff
SSDEEP 3072:UurlxKcmWTTt7Zde2vBVQF4EWjFRA229YvepcCBKXnpU:vrlOWFddeAVQF4EWx92iepcCBK3
TLSH
T18504282A27ECDD45E0BD4B75A7B2278083B8ED079613C70E4AE450F86D3775269063EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c.vbs

Path C:\Users\Admin\Downloads\c.vbs
Size 201B
SHA256 5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1
MD5 02b937ceef5da308c5689fcdb3fb12e9
SHA1 fa5490ea513c1b0ee01038c18cb641a51f459507
SHA512 843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653
TLSH
T1DED0122EA4D9E9675263A153463AD64CC5E258607B21B7119F92EE08736043C0E7E043
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 249e9c7b4660814a6906c8683c7ebadc746e29a5a7be71ba9a312ae84dd068a1
MD5 30495d81b37c8965c8258f91e28ed6d5
SHA1 8f39a045d6f5589252de16bdbceaa881f655ac1e
SHA512 dc6e7a5e43aff1ef43100ef5a1dfe851079272e45a89172d80f3cac678dd1a3cb543f3dca74682f54e9e676ac450a07827a0e11eeb9a772a9a2aabad00c95574
TLSH
T121F012046241150DDD18123D001447938531CF4812004BC288204086827D1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

c.wry

Path C:\Users\Admin\Downloads\c.wry
Size 628B
SHA256 bf22e8e18db1638673f47591a13d18ee58d8c6019314bab5a90be82ae3dc9538
MD5 663e55df21852bc8870b86bc38e58262
SHA1 1c691bf030ecfce78a9476fbdef3afe61724e6a9
SHA512 6a54be1fa549633a2fd888c559207437b8f6efda98bb18d491c8749f39e9754f1e680fa8e2d623777b5f665b2c04d19385c75ce4e61fb251db16018963a9a6f9
TLSH
T155F012046281190CDD18023D001045538530CB4412008B8244204042827C1F36844134
MD5 SHA1 SHA512 TLSH

Submit Download

m.wry

Path C:\Users\Admin\Downloads\m.wry
Size 42KB
SHA256 402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9
MD5 980b08bac152aff3f9b0136b616affa5
SHA1 2a9c9601ea038f790cc29379c79407356a3d25a3
SHA512 100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496
SSDEEP 384:S9sLTK3SWTsPzy3EFejoJQBO21z4oCTeo75Y3kmA31dv61QyU:S9s3mjoJb21zZrS14I
TLSH
T12D1320B800425795D26323E4FB27F0497B2BF41464E584D876EBC2BD717FDACE660A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

r.wry

Path C:\Users\Admin\Downloads\r.wry
Size 729B
SHA256 c9e9dc06f500ae39bfeb4671233cc97bb6dab58d97bb94aba4a2e0e509418d35
MD5 880e6a619106b3def7e1255f67cb8099
SHA1 8b3a90b2103a92d9facbfb1f64cb0841d97b4de7
SHA512 c35ca30e0131ae4ee3429610ce4914a36b681d2c406f67816f725aa336969c2996347268cb3d19c22abaa4e2740ae86f4210b872610a38b4fa09ee80fcf36243
TLSH
T10001106EAE5576110BB1C972317EA157FA06419F022D0262BC0A913D17BC17620FB4F1
MD5 SHA1 SHA512 TLSH

Submit Download

scr.txt

Path C:\Users\Admin\Downloads\scr.txt
Size 45B
SHA256 7e9cde40095f2a877375cb30fecd4f64cf328e3ab11baed5242f73cbb94bd394
MD5 ad1869d6f0b2b809394605d3e73eeb74
SHA1 4bdedd14bfea9f891b98c4cc82c5f82a58df67f6
SHA512 8fe0f269daf94feaa246a644dbeeda52916855f1d2bfd2c6c876c7c9c80b0ceb7e42caf0b64a70bda9a64d4529b885aaa38998a515d6abbe88ad367e72324136
MD5 SHA1 SHA512

Submit Download

t.wry

Path C:\Users\Admin\Downloads\t.wry
Size 68KB
SHA256 a7dd727b4e0707026186fcab24ff922da50368e1a4825350bd9c4828c739a825
MD5 5557ee73699322602d9ae8294e64ce10
SHA1 1759643cf8bfd0fb8447fd31c5b616397c27be96
SHA512 77740de21603fe5dbb0d9971e18ec438a9df7aaa5cea6bd6ef5410e0ab38a06ce77fbaeb8fc68e0177323e6f21d0cee9410e21b7e77e8d60cc17f7d93fdb3d5e
SSDEEP 1536:L/MNGh1blJ3aMfSSPz/chKRb7Z3DK1YwVp2sQ6plKRPNV0BCg:L/sQES7b/jZ3AYgp+Na
TLSH
T1376302D7EBB42A9F7E210D483894BEAC3325834644F3515FE091DF061A68BBCA39529D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

u.wry

Path C:\Users\Admin\Downloads\u.wry
Size 236KB
SHA256 78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df
MD5 cf1416074cd7791ab80a18f9e7e219d9
SHA1 276d2ec82c518d887a8a3608e51c56fa28716ded
SHA512 0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5
SSDEEP 3072:KeJJ0eIVAnbWOECR+uJ/0EJzBelG4t1nXFnQamKNQHFZde5tHEGaa:bqrVOEgZJcYelG4tQamKN2ex
TLSH
T16A34A416ACD3812DF3D736B88001C7BCA8A72E1095261B7BB694F8DC18367E5CE6651E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/776-2846-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3286-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3330-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-2844-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-2839-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-2874-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3318-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3296-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3283-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3284-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3084-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-2880-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-3267-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/776-2883-0x0000026F0F780000-0x0000026F0F8AA000-memory.dmp

Download

memory/776-3243-0x0000026F73870000-0x0000026F73871000-memory.dmp

Download

memory/1184-13-0x000002974E110000-0x000002974E23A000-memory.dmp

Download

memory/1296-3260-0x00000000008E0000-0x00000000008EE000-memory.dmp

Download

memory/1296-3276-0x000000001B440000-0x000000001B56A000-memory.dmp

Download

memory/2040-2807-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/2344-2878-0x000001DBE3C50000-0x000001DBE3D7A000-memory.dmp

Download

memory/2804-541-0x0000000010000000-0x0000000010012000-memory.dmp

Download

memory/4676-2752-0x000001F0CA5E0000-0x000001F0CA5EC000-memory.dmp

Download

memory/4676-2751-0x000001F0CA330000-0x000001F0CA45A000-memory.dmp

Download

memory/5884-3103-0x00000231608D0000-0x00000231609FA000-memory.dmp

Download

memory/5948-2884-0x000002B522540000-0x000002B52266A000-memory.dmp

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads