killmbr | b2dc9a0b1f30a87e8071bc7f01fd2679f9de818b7cf0f4c410ecf8a33d867b8e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/05/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
run.ps1
Size 173B
Sample260516-2cerbsdv7m
SHA256 b2dc9a0b1f30a87e8071bc7f01fd2679f9de818b7cf0f4c410ecf8a33d867b8e
MD5 4b1da7eada611c909864bb0199c62250
SHA1 d484ef3128e623a259bd38416fed16c2273d6abc
SHA512 c6f805a6088bcb1ec07162cb778550aeb3326c161aeba4bb27b1c57fc7e45e09c844710fe824e3e0a0f4de96b24e94cb4e9f1239589ce9110c889ed5057813c4
TLSH
T198C08C6233327874078368CCD93061E89255968BD64CBCE33DE0903B47567A20332926
MD5 SHA1 SHA512 TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024595-194.dat	family_killmbr

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1192	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
636	MEMZ.exe
4148	MEMZ.exe
1364	MEMZ.exe
3516	MEMZ.exe
4452	MEMZ.exe
3008	MEMZ.exe
2832	MEMZ.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	raw.githubusercontent.com
2	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping220_468996248\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1192	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134236941928345075"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{CEF23918-5EF2-4BC5-9864-CA8680230AEB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1192	powershell.exe
1192	powershell.exe
4148	MEMZ.exe
4148	MEMZ.exe
1364	MEMZ.exe
1364	MEMZ.exe
4148	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
4452	MEMZ.exe
4452	MEMZ.exe
1364	MEMZ.exe
1364	MEMZ.exe
4452	MEMZ.exe
4452	MEMZ.exe
3008	MEMZ.exe
3008	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
1364	MEMZ.exe
1364	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
1364	MEMZ.exe
1364	MEMZ.exe
3008	MEMZ.exe
3008	MEMZ.exe
4452	MEMZ.exe
4452	MEMZ.exe
3008	MEMZ.exe
1364	MEMZ.exe
1364	MEMZ.exe
3008	MEMZ.exe
1364	MEMZ.exe
3008	MEMZ.exe
1364	MEMZ.exe
3008	MEMZ.exe
4452	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
4452	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
1364	MEMZ.exe
1364	MEMZ.exe
4452	MEMZ.exe
4452	MEMZ.exe
3008	MEMZ.exe
3008	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe
3516	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3368	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1192	powershell.exe
Token: 33	3368	mmc.exe
Token: SeIncBasePriorityPrivilege	3368	mmc.exe
Token: 33	3368	mmc.exe
Token: SeIncBasePriorityPrivilege	3368	mmc.exe
Token: 33	3368	mmc.exe
Token: SeIncBasePriorityPrivilege	3368	mmc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
220	msedge.exe
220	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2832	MEMZ.exe
5352	mmc.exe
3368	mmc.exe
3368	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 4388	1192	powershell.exe	88
PID 4388 wrote to memory of 2076	4388	cmd.exe	89
PID 4388 wrote to memory of 636	4388	cmd.exe	90
PID 636 wrote to memory of 4148	636	MEMZ.exe	94
PID 636 wrote to memory of 1364	636	MEMZ.exe	95
PID 636 wrote to memory of 3516	636	MEMZ.exe	96
PID 636 wrote to memory of 4452	636	MEMZ.exe	97
PID 636 wrote to memory of 3008	636	MEMZ.exe	98
PID 636 wrote to memory of 2832	636	MEMZ.exe	99
PID 2832 wrote to memory of 1296	2832	MEMZ.exe	101
PID 2832 wrote to memory of 2720	2832	MEMZ.exe	108
PID 2720 wrote to memory of 220	2720	msedge.exe	109
PID 220 wrote to memory of 3544	220	msedge.exe	110
PID 220 wrote to memory of 5028	220	msedge.exe	111
PID 220 wrote to memory of 4892	220	msedge.exe	112
PID 220 wrote to memory of 4892	220	msedge.exe	112
PID 220 wrote to memory of 4892	220	msedge.exe	112
PID 220 wrote to memory of 1388	220	msedge.exe	113
PID 220 wrote to memory of 1388	220	msedge.exe	113
PID 220 wrote to memory of 2208	220	msedge.exe	114
PID 220 wrote to memory of 2208	220	msedge.exe	114
PID 220 wrote to memory of 2208	220	msedge.exe	114
PID 220 wrote to memory of 4008	220	msedge.exe	115
PID 220 wrote to memory of 4008	220	msedge.exe	115
PID 220 wrote to memory of 4008	220	msedge.exe	115
PID 220 wrote to memory of 4460	220	msedge.exe	117
PID 220 wrote to memory of 4460	220	msedge.exe	117
PID 220 wrote to memory of 4460	220	msedge.exe	117
PID 220 wrote to memory of 4908	220	msedge.exe	118
PID 220 wrote to memory of 4908	220	msedge.exe	118
PID 220 wrote to memory of 4908	220	msedge.exe	118
PID 220 wrote to memory of 752	220	msedge.exe	121
PID 220 wrote to memory of 752	220	msedge.exe	121
PID 220 wrote to memory of 4348	220	msedge.exe	130
PID 220 wrote to memory of 4348	220	msedge.exe	130
PID 220 wrote to memory of 4284	220	msedge.exe	123
PID 220 wrote to memory of 4284	220	msedge.exe	123
PID 220 wrote to memory of 4284	220	msedge.exe	123
PID 220 wrote to memory of 536	220	msedge.exe	125
PID 220 wrote to memory of 4816	220	msedge.exe	126
PID 220 wrote to memory of 536	220	msedge.exe	125
PID 220 wrote to memory of 4816	220	msedge.exe	126
PID 220 wrote to memory of 5048	220	msedge.exe	128
PID 220 wrote to memory of 4832	220	msedge.exe	129
PID 220 wrote to memory of 4832	220	msedge.exe	129
PID 220 wrote to memory of 4348	220	msedge.exe	130
PID 220 wrote to memory of 4348	220	msedge.exe	130
PID 220 wrote to memory of 2960	220	msedge.exe	132
PID 220 wrote to memory of 2960	220	msedge.exe	132
PID 220 wrote to memory of 5284	220	msedge.exe	134
PID 220 wrote to memory of 5284	220	msedge.exe	134
PID 220 wrote to memory of 5292	220	msedge.exe	135
PID 220 wrote to memory of 5292	220	msedge.exe	135
PID 2832 wrote to memory of 5156	2832	MEMZ.exe	136
PID 5156 wrote to memory of 5172	5156	msedge.exe	137
PID 220 wrote to memory of 5184	220	msedge.exe	138
PID 220 wrote to memory of 5184	220	msedge.exe	138
PID 220 wrote to memory of 5184	220	msedge.exe	138
PID 220 wrote to memory of 3540	220	msedge.exe	139
PID 220 wrote to memory of 3540	220	msedge.exe	139
PID 220 wrote to memory of 3540	220	msedge.exe	139
PID 220 wrote to memory of 5520	220	msedge.exe	140
PID 220 wrote to memory of 5528	220	msedge.exe	141
PID 220 wrote to memory of 5532	220	msedge.exe	142

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\run.ps1
1⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4388
- - C:\Windows\system32\cscript.exe
    cscript x.js
    3⤵
    PID:2076
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:636
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4148
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1364
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3516
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4452
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:3008
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2832
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\System32\notepad.exe" \note.txt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1296
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2720
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=facebook+hacking+tool+free+download+no+virus+working+2016
        6⤵
        Drops file in Program Files directory
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:220
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2a8,0x7ff8647fc188,0x7ff8647fc194,0x7ff8647fc1a0
        7⤵
        
        PID:3544
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,276038159586887149,12956066836810194350,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:5028
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,8941127845615263227,2069361048724249901,262144 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
        7⤵
        
        PID:4892
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,3396532869294393143,5812036898867749121,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
        7⤵
        
        PID:1388
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,7616484251721960964,6861680725764097080,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
        7⤵
        
        PID:2208
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15610169633270537317,9735151600670524192,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
        7⤵
        
        PID:4008
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,8081887867879336864,7636291400020492886,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
        7⤵
        
        PID:4460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,4515437154233006092,12278741751877019950,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
        7⤵
        
        PID:4908
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,11649899345767260864,2170130962648084882,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
        7⤵
        
        PID:752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,8825667770503147892,4014093235340305221,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
        7⤵
        
        PID:4348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5412,i,9979584755608823566,17722788023470316363,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
        7⤵
        
        PID:4284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,15422108036653542489,10374602651281039328,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:8
        7⤵
        
        PID:536
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,2365193716025875108,2106736671651333718,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
        7⤵
        
        PID:4816
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2836412636976669488,7528874049851533269,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
        7⤵
        
        PID:3724
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,2836412636976669488,7528874049851533269,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
        7⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,6216199588804880765,1807482432759787120,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
        7⤵
        
        PID:4832
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,17954882406812380598,10869751475560996631,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
        7⤵
        
        PID:4348
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,14533093245772003071,271090352727396617,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
        7⤵
        
        PID:2960
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,9366271918055760282,18154377161834720231,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
        7⤵
        
        PID:5284
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,10940258708172668202,5141913288310632467,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
        7⤵
        
        PID:5292
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4360,i,8610801400357593289,13784501070960224062,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:1
        7⤵
        
        PID:5184
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6560,i,13939243482405006975,10152298494221369521,2097152 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
        7⤵
        
        PID:3540
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,14542105060621807288,4812876149922146910,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
        7⤵
        
        PID:5520
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,5486530741081461857,8773487993534518261,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
        7⤵
        
        PID:5528
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,6130602450290521147,4190752887379400723,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
        7⤵
        
        PID:5532
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,15640823801688561231,918103063197957166,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:8
        7⤵
        
        PID:1728
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,7017229121794410242,14948555619361948832,524288 --field-trial-handle=2268,i,16644866738540850766,8536042014211472379,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
        7⤵
        
        PID:5332
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5156
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
        6⤵
        
        PID:5172
    - - C:\Windows\SysWOW64\mmc.exe
        
        "C:\Windows\System32\mmc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5352
      - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        6⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:3368
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3188
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:440

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4f4 0x4ec
1⤵
PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping220_468996248\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
MD5 3c974a700ca35a09f8c2b49b1532d825
SHA1 c8bfc7bbffa5a8b16f303fb3855c7272f8cd2207
SHA512 d0f0c915c5c5723353ebb14545f03ebb586f6004eadf2c4989a392b096d18eb0d4d7b393ef79d0e5b3d4fcce239d92a12d86c978f01ea96a23a5eccc24d012f9
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T1AAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

49a4da76-9c17-49d1-8250-7b4552ba50fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49a4da76-9c17-49d1-8250-7b4552ba50fa.tmp
Size 13KB
SHA256 798c43cfe09c48579e7ee27c30cd1e38152cff712407fa7fc901c25aba8131f9
MD5 ab8a1c1c0d43ee77bf93f5afe565662e
SHA1 aa4640e689f3f4cb57f12b292bb4af3bec65648d
SHA512 ed638567eced48dd111eafb04f8743d66c4f120582cf6d3bd66e643437143212cc15a3ba5bef964df5c34666821b276074a5ed051abad510e04d79899eb46015
SSDEEP 192:sxZMRKyM/jK1Ml8MjA/fqsonqCheM+IdpVkVHW6+WN8/c/YIF3nIg4J:sxZMU7A/fqson/e0CHbX/fc
TLSH
T13B52FA16BB34597BCCD7D209FA55BB53D6F81562A6940E44ADFCCA0C04E6AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fb82355c066708da81f8c84230bfc485b067d45af9ab2065ffe971f4eefce69e
MD5 e05234d8d0d12b72d3ead6e30cf49e7f
SHA1 8f7606214347935f18e0150b66de952e25fba0c3
SHA512 9f4ea95d8560f36b4325ea5d911218067b313112071f3218c026e135a74a30607da2451a7cc75cf4cd68304faa582f5868c140e9952229f64af9f59b56c19f56
TLSH
T1D171B575064ECA63E3A50A7252D13337F5FF85DAF6239E4624544C762518F12861CBBC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597c4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597c4a.TMP
Size 3KB
SHA256 1b7411115023d63efc5f4ff9e8a4de05c56b8c235ce468d1aa7c2ff5eee27032
MD5 c2358cff98dda61db1d1269e9b17b327
SHA1 d3d5eb68d90276f5de779bbd4551a3fd655cd6dc
SHA512 0a327930258d69cd6d0175268e34445facddce336dac6835125424c443700f42b5c19ddc475f110a9f8c1d0cd7cc080fc6a59367e66139279deccbce9d4295bc
TLSH
T18F71A575064EC663E3A90A7252E13337F5FF89DAF6239E4A20545C762A18F11861C7FC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 5fc410f3b809fad24a5fdd4a6784617f666a2009dc02201e10b51c4faea6c7a2
MD5 2721f553c51720bd1754007f867a9ff6
SHA1 b6631fbb373c930569151ef021b793de9c1a6aa5
SHA512 dfc07117561253f657c5c771b74fb083377981c8e3ccee1f45de36add697771ae7086862d86d1dc58c044a0023660af573aa25f8858b2354d8066278bb49352a
SSDEEP 48:YALlNTNOmwm9mamRPmum8gyEPmQm5XsvRs4QzEsdfo7wEsZgmzstCKsQVsmfusik:DjOXklm5h2laOTQzJawVqT5fQ5ohT2q
TLSH
T158B18CF7C2E8852ECC6166F4AB257F2FCE1D0918421C3E1A88D99F5B93D28B1E10565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 fb3a01fe9905787f45828b3eb3f2a4100643635c34fb9e347b4b0515b04623f0
MD5 606eb8c360d8a086b7945eeb7c579e73
SHA1 7ef5613a57839b80c215a6e89214f60dcd62aabf
SHA512 05e0a82d48c5779ff925f53d51f44ab798699472ffd820daa94a85da058f1a3dcb4bd26b962b6bdb8a0fafc3f3764ff4810c63f6c3322fbd7cd004fb22eaa01b
SSDEEP 768:HTsqx8J7pLuLXJlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyWY4Ll6AR9IroO:HTsqx8fEXJlWvJD6Tu1jaLWY4LAs9zMR
TLSH
T12FF2FC3B6D0CCB7E4F804E9CED2A7E9A6DE801CB5698C95447FA840C03C66EB11175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bc61e9a9f65bcbae0265ca519cba6c99017021f5242d45210e173c1ee1f04e3a
MD5 0e6aa4ea316d3b4db7e295b91f92a7ac
SHA1 9adfe3300079e9abe0173aba89ed3520bed49634
SHA512 518ce6ba66d3407de122816459969ddbdb3b54cf219997284f1a78cb656dcf6b5cb57d7c6cb1836c088e23f3aa1b9b26db36ef178ac88bee9bcdc0231ff85fb2
TLSH
T1B4A0022202D65C4BDC604370D38111C82715CD104351C2038892004D8D6218BA20B284
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 19173d71cf03db2d6e195a06480855c2b7b7c1b349d3a4c6c617f885ada5e35b
MD5 023961fed0d3d4417caf7496b72144b2
SHA1 b24fb790293a26a76f3775e730e5541cea57d110
SHA512 8c9a90dc2491271aef0a0e418e0c91dab3d4721a574398f071ab2ea409e82bda824fcc2fdd7f751c701be31f88acc40e15c26cb922f866240909aec1747c1b44
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTylDIRK4A0TyRCIfKPKcfyZ2IfKf6cN:KYbaKYIKeDaK4AKiCQKPKOK2gKf6G
TLSH
T1A7C12216327A1652383D2958B26686770F423AB3301CF47F7FB964A50B66E224CFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fdbf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fdbf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a28f9f22bfeac844827a9037e23739c0dac1a0584fbe2f8db4f9bb240cea1d27
MD5 f07e5fb174905c227e53e91724080e42
SHA1 3d92143b6d9f42f807c3b959e7358e0b72c12774
SHA512 c185f9ea82410bd151338aad1351febc85911b7f837aa4a46bf9aabc58f0c8c4edd895eb00ed0771c123547e2dc4ed8b1db2d7d178f4690fcb343da98bd87f0c
SSDEEP 192:zufsNXwlQ8E8kRbfAQmiU1DTbB4VRNA+Fd10JoLkGwPZSRt/mBrn:zMsNX2iXb4hbuVRNzdTLJ6T
TLSH
T1B0422A327C345C7759E7A552F44B36039FF4906B9AC93F84A5EC9F0C01EB6AC130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 3fafd5143b0a5996bea7dd3e7d5deeb0e7aa06b1ce8a4722568d71d97171f539
MD5 f681f218980070a667f301b9101f9ae1
SHA1 4347526cfe20191e9d27943f6d8c577d937d791b
SHA512 1be62b320e698068ea57ccbca08e9e7ee29ca0957c591e1dbb934adadc451414f2002c4a71c67c76b3bb5518f67dbb39602d563df99ceb6485c9c2519900a3eb
SSDEEP 192:zufsNXwlQ8E8kRbfCQmiU1DTbB4VRNA+Fd10JoLkGwPZSRt/mBrn:zMsNX2iXbGhbuVRNzdTLJ6T
TLSH
T116422A327C345C7759E7A552F44B36039FF4906B9AC93F84A5EC9F0C01EB6AC130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2016a34796e79381bde4b9689d1270b84693cce5a4c49d7ab59c1cefa0ad4cec
MD5 abd75ec0276e62cd466a4b28784f05f8
SHA1 9e25e16de06605cdce930a0df2cb231ceffed063
SHA512 a50c00024c37d590fbefdc6b20be42b272332508a142e588d5769d8214deac7fed7e3d3dcefd3a2007cb9226e2aba736cee833d9c1118fe6be62d11291b2547a
SSDEEP 192:tONx6JkRtQmiUy4kW+RNA+Fd10JoLkRh3aRRU6:tONx6UrgW+RNzdTLMAU6
TLSH
T1DD02C8356D782C7B9EF2AD0AB48B27135FE4216BBA992B84D6E81B0C01D765C1347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 d167eb0fbe016b01e5f81f11ca730ba069de5ca89596a99e7598a50433771b42
MD5 fd5b9a9fbfd794c28f4ca871849fb280
SHA1 7871a4b5e31f03949b51fb0bd01b241949c89270
SHA512 43ddc83f1f667a4f446af352129a17ff80b2ec3d5aad5bb6c68a9460cb9b61975f76ed335af0af059d3ba97d0b550474cd4deb338a7289d17022881adf882bbb
SSDEEP 384:nmCcmyWCTsNXsiXb4hbuVRNzdTLJ6Zjqn:lcpTdgHzR16Zjqn
TLSH
T122726B316C381C7799E6B516F48B36039FF4D07B9AC92F95D5ED5B0D01DB2AC130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 e3885584324624227fb5dad7541082e0cda04399333bf4d17917eaf21cf8fb0e
MD5 df68103aef3c062d29445c87c5a82523
SHA1 9a150b82e1ab02cad47611b0d9cbc06995e7530c
SHA512 348d3762d330ac411d96bcc763a1947d2a7cb8ff9697d19732e0bb735e9e6ddda07573237d9cbb3284fe353040d5204eff2b86a199dab0283fa0bfc199de68b5
SSDEEP 384:nv/CcmyWCTsNXliXb4kbP2VRNzdTLJ6Zjqn:ScpT7zUHzR16Zjqn
TLSH
T1CF725B316C381C7799E6B516F48B36039FF4D07B9AC92F95D6ED5B0D01EB2AC130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 8fe339b530e3beed33c8bb85301a279f3b4af34d9d78b27a3ac3cd72a2f67d73
MD5 79930ffab4bc3dc328c853eefa3f18a8
SHA1 ac20b7b795d7629ad47521e0d6a99c0735b596c4
SHA512 6a8f363f30cb78fd5fe703bd335532743faf9dcabe8cb99c8e048eb35ee8da9ffe6cece50b3b548990d020d008deca191ec357912d9fd56eb2a664173b2a69b3
SSDEEP 384:nHniFTCcmyWCPksNp8TUNTUlIlBiXb4kbP2ZDfQZRNzdTLg6Zjqn:CFmcpcswg0z1ZHzRU6Zjqn
TLSH
T1A2A20932ECA4CD3BADE79786F64B76439EE041678ACD69D4DADD5E0C00971EC130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 360f25bbe622a0b752b1344a94a1136186e4da74b7b721e985956281bac7f9fe
MD5 4cc40d9622ac28cfa87e265ca6c4a575
SHA1 c83ee49bfce0eb19b3302afb0c20a69fb1aa4065
SHA512 e4c5ac6d19e9202072cdfc06c2656551d8190797b834050b87a4e24dfc6b99a7aafc16c4343539af3402f19b6a77d8dc4506091c0db2613b7cfb831590db41d3
SSDEEP 192:tONC6JkRwQmiUy3kO+RNA+Fd10JoLkGwP1Vct/mBU6:tONC6UwxO+RNzdTLf6U6
TLSH
T1D112F9316C785C7B5EE2A816F48736035FE4912BEE897F90D5EC5B0C01EB59C134A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 90824d1e41fa5c1225defce3a4e9e970735526508c0eccd0b98c4274f648be0e
MD5 c8813be17db08e0e69e5e5d4c4be67f8
SHA1 9064a259e0e0057be1b1ddbf3e7792aea0a70d56
SHA512 ff174d9a24625f434acf6fced8cc1c072324328c42f964446363c7214eb0d4623b346afd894a4055b999aaee62751432f551ff891af7cbf4759e8384c9ebaf1a
TLSH
T15241F758A6ED1149F3B76E569BF7A86D887FBC772E07D49E10010E8E0622A44CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

34aaeb54-a99b-4eac-b4f1-d9621eea2650.tmp

Path C:\Users\Admin\AppData\Local\Temp\34aaeb54-a99b-4eac-b4f1-d9621eea2650.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

MEMZ-Destructive.bat

Path C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bat
Size 13KB
SHA256 5e2cd213ff47b7657abd9167c38ffd8b53c13261fe22adddea92b5a2d9e320ad
MD5 4e2a7f369378a76d1df4d8c448f712af
SHA1 1192b4d01254a8704e6d6ae17dc2ec28a7ad5a49
SHA512 90e6eedca424e2ee37c78e0c0380db490c049b0378541812734c134510c40c6e4c48c4e213f395339ed99ff337ef087b6056ac5aafb246c1789ca6082dcabd2e
SSDEEP 192:AOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllz3:AVODaDSHMql3yqlxy5L1xcjwrlz3
TLSH
T1BB528D3236754E13193326CB5C3AA256BCF4503F761A6E71A4138DFB90AAFD1319EB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_5ax03tel.tba.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5ax03tel.tba.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b63bfb20-1b5e-4ddd-96e2-6ec50f99ff25.tmp

Path C:\Users\Admin\AppData\Local\Temp\b63bfb20-1b5e-4ddd-96e2-6ec50f99ff25.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8610af05-73f0-4fdc-a96c-adf0083b8d4a.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir220_117077024\8610af05-73f0-4fdc-a96c-adf0083b8d4a.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir220_219683457\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH