killmbr | 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 14:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Geometry dash auto speedhack.bat
Size 13KB
Sample260418-sc1jcsct2l
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
TLSH
T1BB528D3236754E13193326CB5C3AA256BCF4503F761A6E71A4138DFB90AAFD1319EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral3/files/0x0002000000023199-182.dat	family_killmbr

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
4064	MEMZ.exe
3268	MEMZ.exe
612	MEMZ.exe
5940	MEMZ.exe
536	MEMZ.exe
2124	MEMZ.exe
1300	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ro\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\or\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\page_embed_script.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\en_GB\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\es\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\hy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\gu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\sq\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ka\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ru\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\uz\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\sv\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\mn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\pt_PT\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\sw\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\mr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\pt_BR\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\vi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\it\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\kn\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ko\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\eu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ne\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\fi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\et\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ml\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ja\messages.json	msedge.exe
File created	C:\Program Files\msedge_url_fetcher_6048_384316664\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\hr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ms\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\hi\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\da\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\is\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\pl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\service_worker_bin_prod.js	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\bg\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\fa\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\id\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\sr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ca\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\si\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\en_CA\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\tr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\en\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\de\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\en_US\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\fr\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_1902504257\manifest.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\es_419\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\el\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\ur\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\cy\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\gl\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\zu\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\dasherSettingSchema.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\az\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\lt\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\af\messages.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_1902504257\keys.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_1902504257\_metadata\verified_contents.json	msedge.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping6048_611387892\_locales\fil\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
344	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134209980395490563"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1609746302-1884177235-1125644204-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1609746302-1884177235-1125644204-1000\{F95C2F65-547B-45E0-A337-26DCE0200B68}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3268	MEMZ.exe
3268	MEMZ.exe
612	MEMZ.exe
612	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
612	MEMZ.exe
612	MEMZ.exe
3268	MEMZ.exe
3268	MEMZ.exe
3268	MEMZ.exe
3268	MEMZ.exe
612	MEMZ.exe
612	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
612	MEMZ.exe
3268	MEMZ.exe
612	MEMZ.exe
3268	MEMZ.exe
2124	MEMZ.exe
2124	MEMZ.exe
2124	MEMZ.exe
3268	MEMZ.exe
2124	MEMZ.exe
3268	MEMZ.exe
612	MEMZ.exe
612	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
612	MEMZ.exe
612	MEMZ.exe
3268	MEMZ.exe
3268	MEMZ.exe
2124	MEMZ.exe
2124	MEMZ.exe
612	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
612	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
536	MEMZ.exe
612	MEMZ.exe
612	MEMZ.exe
5940	MEMZ.exe
5940	MEMZ.exe
2124	MEMZ.exe
2124	MEMZ.exe
3268	MEMZ.exe
3268	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe
6048	msedge.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
6048	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1300	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 5436	4716	cmd.exe	85
PID 4716 wrote to memory of 4064	4716	cmd.exe	86
PID 4064 wrote to memory of 3268	4064	MEMZ.exe	87
PID 4064 wrote to memory of 612	4064	MEMZ.exe	88
PID 4064 wrote to memory of 5940	4064	MEMZ.exe	89
PID 4064 wrote to memory of 536	4064	MEMZ.exe	90
PID 4064 wrote to memory of 2124	4064	MEMZ.exe	91
PID 4064 wrote to memory of 1300	4064	MEMZ.exe	92
PID 1300 wrote to memory of 1792	1300	MEMZ.exe	94
PID 1300 wrote to memory of 6056	1300	MEMZ.exe	100
PID 6056 wrote to memory of 6048	6056	msedge.exe	101
PID 6048 wrote to memory of 6068	6048	msedge.exe	102
PID 6048 wrote to memory of 344	6048	msedge.exe	103
PID 6048 wrote to memory of 224	6048	msedge.exe	104
PID 6048 wrote to memory of 224	6048	msedge.exe	104
PID 6048 wrote to memory of 224	6048	msedge.exe	104
PID 6048 wrote to memory of 3264	6048	msedge.exe	105
PID 6048 wrote to memory of 3264	6048	msedge.exe	105
PID 6048 wrote to memory of 3768	6048	msedge.exe	106
PID 6048 wrote to memory of 3768	6048	msedge.exe	106
PID 6048 wrote to memory of 3460	6048	msedge.exe	107
PID 6048 wrote to memory of 3768	6048	msedge.exe	106
PID 6048 wrote to memory of 3460	6048	msedge.exe	107
PID 6048 wrote to memory of 3460	6048	msedge.exe	107
PID 6048 wrote to memory of 4524	6048	msedge.exe	111
PID 6048 wrote to memory of 4524	6048	msedge.exe	111
PID 6048 wrote to memory of 4524	6048	msedge.exe	111
PID 6048 wrote to memory of 5372	6048	msedge.exe	113
PID 6048 wrote to memory of 4964	6048	msedge.exe	114
PID 6048 wrote to memory of 5372	6048	msedge.exe	113
PID 6048 wrote to memory of 4964	6048	msedge.exe	114
PID 6048 wrote to memory of 2556	6048	msedge.exe	116
PID 1300 wrote to memory of 3420	1300	MEMZ.exe	121
PID 3420 wrote to memory of 5996	3420	msedge.exe	122
PID 6048 wrote to memory of 5684	6048	msedge.exe	123
PID 6048 wrote to memory of 5684	6048	msedge.exe	123
PID 6048 wrote to memory of 5684	6048	msedge.exe	123
PID 6048 wrote to memory of 1808	6048	msedge.exe	124
PID 6048 wrote to memory of 1808	6048	msedge.exe	124
PID 6048 wrote to memory of 1808	6048	msedge.exe	124
PID 6048 wrote to memory of 3492	6048	msedge.exe	126
PID 6048 wrote to memory of 1052	6048	msedge.exe	127
PID 6048 wrote to memory of 4952	6048	msedge.exe	128
PID 6048 wrote to memory of 2768	6048	msedge.exe	129
PID 6048 wrote to memory of 2768	6048	msedge.exe	129
PID 6048 wrote to memory of 4360	6048	msedge.exe	130
PID 6048 wrote to memory of 4360	6048	msedge.exe	130
PID 1300 wrote to memory of 5004	1300	MEMZ.exe	132
PID 5004 wrote to memory of 6076	5004	msedge.exe	133
PID 6048 wrote to memory of 5304	6048	msedge.exe	134
PID 6048 wrote to memory of 5304	6048	msedge.exe	134
PID 6048 wrote to memory of 5304	6048	msedge.exe	134
PID 6048 wrote to memory of 5296	6048	msedge.exe	135
PID 6048 wrote to memory of 5296	6048	msedge.exe	135
PID 6048 wrote to memory of 5296	6048	msedge.exe	135
PID 6048 wrote to memory of 2772	6048	msedge.exe	136
PID 6048 wrote to memory of 2772	6048	msedge.exe	136
PID 1300 wrote to memory of 5348	1300	MEMZ.exe	138
PID 5348 wrote to memory of 6024	5348	msedge.exe	139
PID 6048 wrote to memory of 3500	6048	msedge.exe	140
PID 6048 wrote to memory of 3500	6048	msedge.exe	140
PID 6048 wrote to memory of 3500	6048	msedge.exe	140
PID 6048 wrote to memory of 5560	6048	msedge.exe	141
PID 6048 wrote to memory of 5560	6048	msedge.exe	141

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Geometry dash auto speedhack.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:5436
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4064
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:3268
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:612
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:5940
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:536
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2124
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1300
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:1792
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=stanky+danky+maymays
      4⤵
      Suspicious use of WriteProcessMemory
      PID:6056
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=stanky+danky+maymays
        5⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:6048
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2b0,0x7ffd2611c188,0x7ffd2611c194,0x7ffd2611c1a0
        6⤵
        
        PID:6068
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,16612732914336106214,12466943056897634260,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1876,i,17598503301065724968,13870552847683509191,262144 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
        6⤵
        
        PID:224
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,5011212067763065495,8444241874566402162,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:8
        6⤵
        
        PID:3264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10316410944307301930,10958182242992756072,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
        6⤵
        
        PID:3768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,3546838672308419159,11763727088387440900,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
        6⤵
        
        PID:3460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,16801691255754973360,14761029111376374580,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
        6⤵
        
        PID:4524
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,16574220493906816666,309959867122886697,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
        6⤵
        
        PID:5372
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3396,i,2659324739122067371,2050029547987584235,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:8
        6⤵
        
        PID:4964
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,11762466775846503037,14778690241034673532,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
        6⤵
        
        PID:4800
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,11762466775846503037,14778690241034673532,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
        6⤵
        
        PID:2556
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5692,i,1530148016744974713,236855882394189952,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:1
        6⤵
        
        PID:5684
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,4908712090377191421,18209558088610019547,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
        6⤵
        
        PID:1808
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3403414965565727003,4225070424781271639,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
        6⤵
        
        PID:3492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,13132230945463898619,13159964464270853822,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
        6⤵
        
        PID:1052
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,3078381228270401042,2581856159940733106,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
        6⤵
        
        PID:4952
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=556,i,8850735465301758752,14680923968199912353,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
        6⤵
        
        PID:2768
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,2014793440971329429,14960855507337000046,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
        6⤵
        
        PID:4360
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3428,i,16538744800471039237,3212121799048891630,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
        6⤵
        
        PID:5304
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5336,i,13736687242711445555,12387383143673531282,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
        6⤵
        
        PID:5296
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,2344755333011638322,4871195810602745406,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
        6⤵
        
        PID:2772
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6992,i,3430548974499903022,15454812132905044715,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
        6⤵
        
        PID:3500
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7100,i,15451999800229520353,18319246630272967442,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
        6⤵
        
        PID:5560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6328,i,8278000514117989148,4308617329082691912,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
        6⤵
        
        PID:4116
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4888,i,3035441954642807838,12627659349037101573,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
        6⤵
        
        PID:4788
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,2201690851080097152,5554020082879444242,524288 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
        6⤵
        
        PID:3248
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6560,i,14921526489663524009,6773453024759815959,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
        6⤵
        
        PID:5200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6492,i,2594554468501683069,3734749072796284072,2097152 --field-trial-handle=2252,i,9243785302762723078,2400919053039310488,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
        6⤵
        
        PID:5084
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3420
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://answers.microsoft.com/en-us/protect/forum/protect_other-protect_scanning/memz-malwarevirus-trojan-completely-destroying/268bc1c2-39f4-42f8-90c2-597a673b6b45
        5⤵
        
        PID:5996
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5004
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=vinesauce+meme+collection
        5⤵
        
        PID:6076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5348
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://motherboard.vice.com/read/watch-this-malware-turn-a-computer-into-a-digital-hellscape
        5⤵
        
        PID:6024
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
      4⤵
      PID:5320
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=bonzi+buddy+download+free
        5⤵
        
        PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5296

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b4 0x404
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

keys.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6048_1902504257\keys.json
Size 8KB
SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
MD5 d3ebc1cb4b692c6e2d29a4625420fe73
SHA1 4ce74c1e9af6fd34d6379ec0fec6afb24082a7c1
SHA512 e34b855615e6a3bf770f27d85aa29ca57a324c08bd8f8d9c0130e2a142c0e4a5f17bffd0861b725acc8a2316f73b7fe50406b0af26264a5c2d8f37599b260860
SSDEEP 192:uNtGbR+mFGfvPNyR9Pm4lOvMwkoR9PuGMXcy:ORmqwKjA
TLSH
T18402A57F14A41181CE7FC1698F0B78B78FA038065BCA3A83539BFA49494296D173B5B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping6048_1902504257\manifest.json
Size 79B
SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
MD5 817fea104100763cd1bf4f15a51bfe94
SHA1 589717cf98cf7e2d55fc0d6025a4b8e215ed13d6
SHA512 da7b959d93113c5a6be360f90d9c721989c5e7acad7fa592081b582c4c3a0c4a9066a71473fd8492ce7fe7b0fbfd6870d939428a67fbd508fcf6b2c6dc1a41ea
TLSH
T15EA0122058019233108407600360478243551C022015244809461041258813A12A3128
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd04dec9a65c9ebbd9698b7d59631c916e6b6a0a7afdb22ef48d8a4a82d902d0
MD5 5491f296a003c3ba16025eb18fdfb799
SHA1 8104d473f5d8f681400a64b5d0ac5523a5d56b8e
SHA512 118ab6dad3343099380a953888db90a14fe8c7dcb62f906e55a163cdde9b95460d37b865178c48bfd20c166ef6b725e5b61ca55fc83a0221383e062a36b68b84
TLSH
T1CAD080D837B16C26C589947104857F4D351BC4A24D46D7267477297C5CC30C46D555D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c7296caf0e9cce556825f28f3642cb5ac31e31a0ff760d227744d879c3a93dee
MD5 1fd2da899cebd4d5aac2a3d85c0bfd18
SHA1 3f4e6dbc96df63582e9ba17acceda5012e453d7a
SHA512 840622178b39a880be2d80a1349d1dc0f7bfb63bf38c38c71fd96b89033d54de3e6a88f15ad237f3b66a8ebbff2bcfb19f5b6a6e94882c94044f73046f231584
TLSH
T1D5D0C0CC33B13C26C58C807004457F4D340BC4A20D42C3263433297C0CC30C428514C3
MD5 SHA1 SHA512 TLSH

Submit Download

4cea68e0-c023-4b49-983a-ae45c0d5b59a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4cea68e0-c023-4b49-983a-ae45c0d5b59a.tmp
Size 414B
SHA256 70dacf3dbbed9cf01d24f88c42d0378a4772e2468fa5b5bd313ff299d83081e7
MD5 223efa08aff0411450bc300837aae50b
SHA1 c6d894f5071c94ffd5acb5d5b916a96022279d2b
SHA512 e657d0d470c19e25858ee44a70b6d6c0f73feaa813da849e8575ac75083a57fe9f8d787e7930e35a90925a2eb06b37400faea6985b06c02b47844fd8da88835a
TLSH
T161E02BAEC8319C2B14FD071D20124747EB52135B1B50880FBF3D92488FB06370995CAC
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 38KB
SHA256 7165713d3e1a610399471a5e93d5677508f62ef072c1151e72273bf4bd54f916
MD5 9436affc97843765a966b3568fa7e5ec
SHA1 7bfda74bb30589c75d718fbc997f18c6d5cc4a0b
SHA512 473ec3a843c33e18d6d194651fe11353fcd03a7959225faeabf8c77484155ea6a7bccb72dbaf2093ed53c408faa3be9f6fc907f7a5ddf8223375f9d09b504456
SSDEEP 768:eUEh2+iKBVQbBhu8vjenqz2Ez6Y/AxHLEaP72sV9qKYbDblXqhP8qwFSE3uk:eUEEoBVQDjeQaLnP2pfZTqgSEB
TLSH
T11703F112148F7FA1C244F224A4EFE416ACC3F565ABA15E6980B8B7C7010E3C657A46FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 79KB
SHA256 37d735137c75c0c1fed1549a57b69cf945476d3e91eb2adedf62a0b005612210
MD5 ce315b78abf41d88951c76c66166330a
SHA1 484008a6c1eb8ab3055e256721d3a19a939ad751
SHA512 14c4856574c7f802173e84bd6926aa5414285d99962632a0db19dc9890edc6b94b0b6240fd843d1f53abcc79ecaa9eabe2e9f519c21c7636c60a1e5c0035fd5c
SSDEEP 1536:lUvr2XdyWd7VLHYFLRNJQ9u9pkxYeM59IS0m6JsbbVMnmFsHpVA+OVQ/:lGatH5TaL3JSu9/IPm6GVCHH5
TLSH
T1628302249348F8409C689CA01D4BE6C2168E95D052C9AFF11A82DA9BF1B71317FD7F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 094b63f06fb4baf25b6c1c8db4a7256cbc475164dc0242f2500e759469d2c837
MD5 0f700c663ca46d2bec6f82d37016eac6
SHA1 580e12b3c5c84581cb1ba0c4bd12e09b993e1cda
SHA512 81bd3ba9d39e622b470d3a94b63ddf3d78acd8cba1df895c2c46fe445a21f2d97e3d663c9525331810275927e086d99ac965add8795d025ca90a42934f3977d2
TLSH
T1B9515FB42F858929FBE848F0DEA1C03E32F05BB9362BFF3A35F5673E2A166514000521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ef660a914860781c33c8d5d5b7ea80e35cc7e165d4bbac5b8d1ae71fc0a2b0cc
MD5 86c07bb8c51091aec00fa6c5eb810a80
SHA1 7ae4f6d2deaf5afa220c1d87a389be0942a56ca0
SHA512 b89d86566f48b464521d470fa18187a786bc15ce9db69c6ca729e45f7f8043d3fa203f660fc1bd80e01a07a8edc1ae3778e8220afeda87383bf7d2ccb07fcc38
TLSH
T1445172B42F458929FBE848F0CEA5C03E36F05BB9762BFF3936F56B3E2A156104400521
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599f53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599f53.TMP
Size 2KB
SHA256 62e50d70f14dd3d7dedc8012b69c4ca3553e38b269432ca683b588f9b26de891
MD5 b130afa02dcf5acc4282dd62b32e67d0
SHA1 88a073ab016f5211fd288d17802987fe8206c893
SHA512 6d29b48d3b3940d56f3a86eb53184e3dcfe53ded1862272ce27ac7b27ee59abb285e43fa9f4a3f2a1bcc6f5748fb79a852526385f1efae3c2b0d09d2e403ba1c
TLSH
T1225151B42F459969F7E908F0DEA5C03E72F49BB9353BFF3A36B52B3D2A156104400521
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 53431667583df43022721595f2625588ce2994a2c6410e129ef9bae9f3b2992d
MD5 abb7de92cee134941b17cb86ce139d90
SHA1 b75e0eb6dc57f5f254462590306db60e06e33c95
SHA512 18f6108f49987f2841c9b13c0635b28356167e0582c1bbdeb10c7cbc0ec38305814f45aa41cd2dd88fec4856e646736944ac1718e8ea42e9747184794a523d3f
SSDEEP 192:DZPerItIAt21j6xDnGIb5bRTauXO1aBzozD:DZPerItIAt21GxDnGIb5bRTauXO1aBz+
TLSH
T1F8D1AAF7C2E8892ECC5156F4A7267F2FCE2D0918431C3E5A89D59E1B93E2871E10165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f184439460d26f03e832e99c18fa2844cd86bb5268d3c1fa1b85ca695770f38b
MD5 eb34a2b638882a9d0eaed9d6b9f31c0a
SHA1 cf12f1720a298f3312254ba7a40778c7da61559e
SHA512 f2208a2327dca56d4339c7c871a3f54f5fcae59f97809560632a326fd2a1e881ea2ad11f97eb6cebcc90f2da6b88ea680468b2a79644f72bfbd61945887be3a6
SSDEEP 192:sxZcRKyMqZ/K1Ml8MjC/fE4sDYp7rVvTzodpPdhHW6+WN8v0/YKkbdnNcLQIgjHJ:sxZc/7C/fPsD09vIXHbH/inNc4jp
TLSH
T13F72D8166A389D7B8CD6D309F651BF63D6F9552392905D48AAFC8B0C04E7BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 94db22f376250d56cbbafc7344cf0ddec43f708e20918788c9e18234e9631d8b
MD5 ff4c88a5749dec2bf07bc6ba0962cfcb
SHA1 0fe8a77f29c39263a55c9724125f0ddb7e7a11dc
SHA512 8db2766637f75f06c5cf0927abc7d28441c88152063060ea2adbdb4cce2756378ca7d858787eb5c1722b945af024d879542161c06d406894144c67b41ed9aef7
SSDEEP 768:AasqZl+7pLuL/BlWvBDeT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVlvEx4Llhf51Yr4:AasqZl+E/BlWvBDeTu1jaQEx4LXB1jAu
TLSH
T14BF2093B2C0CCB7E4F804E9CDC2A7E8E6EE8028B96D8895447F9841C03D66EB55175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 29bf814616cddcb8e6449caa7f8acf3cb7b8d89caa0650256b277de7d859602b
MD5 dd769ecfa5aaf1c7bc102bf1962c57fa
SHA1 ebb1aa9ab47f1181f780eb35b42fefbdce4a7415
SHA512 718208d72b6e5058a7ba83f6892a2ffd2d41bffd645189c647f3dff1afaefdf2785d8bb9d3481716392883c218a704ccccc772685a7912fbed0b3e5bc60c87e3
SSDEEP 192:+HhOVXSe5i+EkETc3+uWvwAn+mPoOTR7uVhrx9aVYh5D+wHMT7glRZVrd9th/qng:+BOVglYXrbtZqRvJjlm
TLSH
T1E0B25E11753B03803A7E298E9594B46E62C170A37098B43B7BB944A64F6BF20CDFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2af913c843e017a87bbe4b8a70ab4f740418f645ac14963d338b69d82799c2d5
MD5 5cc233498c73686a45783ec5912e01e2
SHA1 93e13d8469de8841e23689e19c4ead58344336ef
SHA512 546b63f7c77e12b1e7170a185d59ea2160c9dfcd9db64d9477977fe6fa16965c9def5598463a22ad07ecbfa6ae6089b8ce3923cdd8091e911dcb00f098918183
SSDEEP 384:ngiFJjccCs+Bt0S3Qw3sN28TUNTUlI4fRih4SV9U8vfDYY0jfzMq+lKpjSBFsz2M:7FJccQ13pwg+i7RYYqfLjSE2f4
TLSH
T118D23B32E8A4CDABEDE68BD9E34A3653DEF00153968C5AD4D9C95E1D00CB1AD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3064d312e1ffc19c224f59aea9f2ef803db40352d5272331f477c4dc324c74fa
MD5 4d0a607cc834e4de8576dba57e5ae504
SHA1 40f836cf738fa4700e3f32d29e9f66f401d72f2f
SHA512 7d99549a85a33b81a4873960c13c61aafe36a45f1747ad16016723a37f5cf3fec3fbe1b336df2ca026cbb61c4ff6533c2d3498c80754a4fcb4e18021f97124c8
SSDEEP 384:n7iFavqMI3sN28TUNTUlI4/Rih6SX9o8vfDYY0jfzMq+lgnjS7o1dKuiNd9xprNd:WFayH3pwg4ir9YYqfxjmo1tiFH1VNF
TLSH
T173D24B32E898C9ABADEA5BC9E70A7A03DEE04257C68C5ED4D9D85E0D10D71ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 85617143e8461e6a26db0cde826c8064e3c16cde94396742363928d0aeb435c0
MD5 b775905aa3e74f4e95c5ab896ee1ea6b
SHA1 424872861eb7c511f180feb14e212a6df8931dc6
SHA512 b5ce6dadfaeea44e18ca5bda379bceac64513823a625bd885d0746f010e48a59324535aee69f2c2531caae58694eba0dad6ac50a2d26dd9003020a72cf49df66
SSDEEP 384:nWiFJjccCs+Bt0S3E3sN28TUNTUlI4fRih4SW9528vfDYY0jfzMq+l3njSBFsz2M:9FJccQk3pwg+iY5vYYqfGjSE2f4
TLSH
T1C4C23B32E8A4CDABEDE68BD9E34A3653DEF00153968C5AD4D9C95E1D00CB1ED130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7f42cd8182a906710dab8307f4003ebbe198d5d957278fc2eb7ca7fe35e0abef
MD5 2c73f285cb0a9c2bcc1787046b6ff03c
SHA1 ee2d0f5d07654a5929d2f78580a502fa95e2663b
SHA512 5e899be973ccb2b50c104951b623f66a415591aece725dc6c7ab2e104921a532c5a21d2dd2b3a0f826bbbfe94ccd31977442ac2d78d317226fbcc90d7de002cf
SSDEEP 384:nu6iFavqMg3sNV8TUNTUlIm2RihYbkr8vfDYY0jfzuQWS7o1dKuiNd9xprN1k+rw:uxFayv3OwgTi58YYqfXWmo1tiFHyVNF
TLSH
T107C25B31EC98D9ABECE64FCAEB4A7A03DEE00297D59C4AD4D9D81E0D10D319D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b8ab18e62f6082b7dc0ca4874d8e2f65eb4becbda6cff9ad803ac2f34051514b
MD5 4384cb1d595e7471f398c9b7c80743ed
SHA1 c54f019a8d062adc3983fee991ddf2cc74926aa5
SHA512 19f1bc1727518d694a40547a0a161b887c46921a5b279c501c14beabf0997454def831fe4abfa3ac5d55acbe54883be7cbda40bcd08a2e68e545a44456ef7f5e
SSDEEP 384:n8iFavqMg3sNS8TUNTUlIm2Rihq55l8vfDYY0jfzMq+lWnjS7o1dKuiNd9xprN1q:nFayv35wgTiqyYYqfNjmo1tiFHyVNF
TLSH
T1D3C25B32E898C9ABADE65FD9E74A7A03DEE04257C68C4ED4D9D81E0D10D71AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cf2d7409bb92a0cee8147d28ddca60719dd04a1222c5c421ef3bf40ad2f78b36
MD5 f90217ef9b3840f4fb08fa914788b1cd
SHA1 e75f34a3db680bee14105f2604ee57d4a1d248d1
SHA512 dbbb630342a1f14970b161a958d347254ace19fb6be95b70a6ce06f8fcb47f4170a8d01c93f34a953c0963202694ed8bc118afb519c2590174ae3a8af3dfe50e
SSDEEP 384:n7iFJjccCs+Bt0S3E3sN28TUNTUlI4fRih4SX9o8vfDYY0jfzMq+l3njSBFsz2rw:WFJccQk3pwg+i99YYqfGjSE2f4
TLSH
T1D0C23B32E8A4CDABEDE68BD9E34A3653DEF00153968C5AD4D9C95E1D00CB1ED130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5f2cdd76f6f5cf878ae5c89abd0cf3b7e494833b3da746ddcc681ffb9a310a67
MD5 c761d41f5faa66e7b913e1ed89642be7
SHA1 d7a0e85ed460d28d2031c0734154ae826b0467ef
SHA512 a7b82250ee6d2cba5b8028786edb027249f6c32e7af65852c0df290471cf2f48e5a198b35289630a45b202ba5efcae68bac4711b829de9b832349ed02172394e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4c08fa3764582cbef74a61e8d02fba022391dd3e503ab97e9f00c3c01af965c2
MD5 c2501f4743d5bb1d0cf0448bcd83458b
SHA1 5f51698e399e8596b46b911cf5a55baecf1f1173
SHA512 4672bc776dde576fa0bb11e90a47517399be3cdfb75f92c088f6cf8baca577fb9ab65878d8bcb002be60680373f17c0515ed3684f35f1850cc7914af6482abf0
TLSH
T1F8E00200D220046FC03C033010C72F703EF4D11137932306A320027C3C233103B24AC8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59b25e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59b25e.TMP
Size 392B
SHA256 367dddf735bb93e9c9da1e2bee5dffe0da5a82f63fff5f95251300a0e81638f6
MD5 b9133cf7e08f2c4fff585d0136f7f9cf
SHA1 1124b2b9c7b1a08d454616a382a409ee1028adfc
SHA512 530ef6abd3cfe15af6c944e22ca8326e9f5cdb287d0f861f07065da4f3b91000326ad6aefcd688e0db93fe650d6865ac41fcdea772815c39d959d500966a19ba
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 6aebed3e26d9490f22933fc7961727f96503eae50370e8242bde76992544453e
MD5 751d99552d039f8bcdfd8d3c3689ffdb
SHA1 732cc7a82d84640b1f40088275f19cb5bfcdc43f
SHA512 e231866c582e04552f861f28a9a062b13fdab07238f8ce8dff5c91dbddde95a6d5c50fa09e562b2fb2f406a5ba69f9b4f2239bbc8ef75e0384e228d6de5adf67
TLSH
T10B4141E14C3E2AD1D4FD0E2EA49778FC95D8C32AF4B4707D5864D9880739A1E604043F
MD5 SHA1 SHA512 TLSH

Submit Download

3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
MD5 b1ac780361002049b0a10a7fd30fd809
SHA1 0ee0a7dc27fd175ab7abd6e5649890be3e2795b5
SHA512 1bd8b1d2dc30bc62728d3d08085a446e8c037b02499687affa9a0bb18c6bdfee19104eabdcd8a52c2d0b542046abf26b7fdf81815037d4923e31231b0dfb7d60
TLSH
T156C02B5538F9488C2FA5257ED238092E12E4C912310022B0002ED804103465C13A0C2F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b6bc3705a84edba27527e92654a035f471605debca696918f11267b51ad3942a
MD5 a934052953e4aa1d29e056c46443005f
SHA1 a0d01c1954419790906b54529d889fd798931e9a
SHA512 461628d45181e644834a14c75161241a773d4eb47a03f5a348f870ca5460e3bd0453c858036234edb5c4a878bf92944853b5bba37ce135217718ded795b59f16
TLSH
T10841275CAAE91108B3B7BF5A9FF6A96D84BB7D732F06945E10110D4F0622A40D972B33
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1792-192-0x0000000004C30000-0x0000000004CDF000-memory.dmp

Download

memory/5436-179-0x0000023E3C0C0000-0x0000023E3C0CC000-memory.dmp

Download