killmbr | 615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1

Analysis

max time kernel
163s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 22:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
Size 84KB
Sample260620-2rx68aas2r
SHA256 615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1
MD5 f8b1e2d0b92311062cd2e1b5bec88e45
SHA1 53b1b3589b8acd715e96ab70f4405f7392092730
SHA512 8936621679326f1684a522dd1b09a3d8f4f5a17c4a13cb8f680718e16fb39d749c2e064cfd4b8915cb456123f14237e745aab88f98dd9a532cacc4e95bcac170
SSDEEP 1536:QVIn7vLAsry2eslLS8Ti1nQyd9O3jKVfOcHoHoPFXOvs/WP:QU/9+vstGGGFO0dXOv6WP
TLSH
T15C837C53B6C24372E68156B4419129B7EB31E73BC3625EC3C3045A07EF561F2CC7A2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000243c4-184.dat	family_killmbr

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
3012	MEMZ.exe
1504	MEMZ.exe
1068	MEMZ.exe
1100	MEMZ.exe
1716	MEMZ.exe
4244	MEMZ.exe
4216	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mspaint.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4880	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264694951280139"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{973D75B7-F93E-44A7-A79C-AB52352137EC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1504	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
1068	MEMZ.exe
1068	MEMZ.exe
1100	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
1100	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
4244	MEMZ.exe
4244	MEMZ.exe
1068	MEMZ.exe
1068	MEMZ.exe
1100	MEMZ.exe
1716	MEMZ.exe
1100	MEMZ.exe
1716	MEMZ.exe
1068	MEMZ.exe
1068	MEMZ.exe
4244	MEMZ.exe
4244	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe
1100	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
1100	MEMZ.exe
1068	MEMZ.exe
1068	MEMZ.exe
4244	MEMZ.exe
4244	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
1504	MEMZ.exe
1716	MEMZ.exe
1504	MEMZ.exe
1716	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
4244	MEMZ.exe
4244	MEMZ.exe
1068	MEMZ.exe
1068	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe
1504	MEMZ.exe
1504	MEMZ.exe
1100	MEMZ.exe
1100	MEMZ.exe
1716	MEMZ.exe
1716	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4940	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: 33	4940	mmc.exe
Token: SeIncBasePriorityPrivilege	4940	mmc.exe
Token: 33	4940	mmc.exe
Token: SeIncBasePriorityPrivilege	4940	mmc.exe
Token: 33	4940	mmc.exe
Token: SeIncBasePriorityPrivilege	4940	mmc.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
4216	MEMZ.exe
3044	mspaint.exe
3044	mspaint.exe
3044	mspaint.exe
3044	mspaint.exe
1672	mmc.exe
4940	mmc.exe
4940	mmc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 5016	4652	615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe	87
PID 5016 wrote to memory of 8	5016	cmd.exe	89
PID 5016 wrote to memory of 3012	5016	cmd.exe	92
PID 3012 wrote to memory of 1504	3012	MEMZ.exe	101
PID 3012 wrote to memory of 1068	3012	MEMZ.exe	102
PID 3012 wrote to memory of 1100	3012	MEMZ.exe	103
PID 3012 wrote to memory of 1716	3012	MEMZ.exe	104
PID 3012 wrote to memory of 4244	3012	MEMZ.exe	105
PID 3012 wrote to memory of 4216	3012	MEMZ.exe	106
PID 4216 wrote to memory of 4832	4216	MEMZ.exe	108
PID 4216 wrote to memory of 3044	4216	MEMZ.exe	112
PID 4216 wrote to memory of 1672	4216	MEMZ.exe	118
PID 1672 wrote to memory of 4940	1672	mmc.exe	119
PID 4216 wrote to memory of 3332	4216	MEMZ.exe	122
PID 3332 wrote to memory of 2500	3332	msedge.exe	123
PID 2500 wrote to memory of 3376	2500	msedge.exe	124
PID 2500 wrote to memory of 4880	2500	msedge.exe	125
PID 2500 wrote to memory of 1652	2500	msedge.exe	126
PID 2500 wrote to memory of 1652	2500	msedge.exe	126
PID 2500 wrote to memory of 752	2500	msedge.exe	127
PID 2500 wrote to memory of 752	2500	msedge.exe	127
PID 2500 wrote to memory of 752	2500	msedge.exe	127
PID 2500 wrote to memory of 5068	2500	msedge.exe	129
PID 2500 wrote to memory of 4168	2500	msedge.exe	130
PID 2500 wrote to memory of 5068	2500	msedge.exe	129
PID 2500 wrote to memory of 5068	2500	msedge.exe	129
PID 2500 wrote to memory of 4168	2500	msedge.exe	130
PID 2500 wrote to memory of 4168	2500	msedge.exe	130
PID 2500 wrote to memory of 2756	2500	msedge.exe	131
PID 2500 wrote to memory of 2756	2500	msedge.exe	131
PID 2500 wrote to memory of 2756	2500	msedge.exe	131
PID 2500 wrote to memory of 4668	2500	msedge.exe	132
PID 2500 wrote to memory of 4668	2500	msedge.exe	132
PID 2500 wrote to memory of 4668	2500	msedge.exe	132
PID 2500 wrote to memory of 2612	2500	msedge.exe	136
PID 2500 wrote to memory of 2612	2500	msedge.exe	136
PID 2500 wrote to memory of 4252	2500	msedge.exe	138
PID 2500 wrote to memory of 4252	2500	msedge.exe	138
PID 2500 wrote to memory of 3696	2500	msedge.exe	139
PID 2500 wrote to memory of 3696	2500	msedge.exe	139
PID 2500 wrote to memory of 3696	2500	msedge.exe	139
PID 2500 wrote to memory of 1272	2500	msedge.exe	140
PID 2500 wrote to memory of 1056	2500	msedge.exe	141
PID 2500 wrote to memory of 1272	2500	msedge.exe	140
PID 2500 wrote to memory of 1056	2500	msedge.exe	141
PID 2500 wrote to memory of 2072	2500	msedge.exe	143
PID 2500 wrote to memory of 2396	2500	msedge.exe	144
PID 2500 wrote to memory of 2396	2500	msedge.exe	144
PID 2500 wrote to memory of 2752	2500	msedge.exe	145
PID 2500 wrote to memory of 2752	2500	msedge.exe	145
PID 2500 wrote to memory of 3040	2500	msedge.exe	146
PID 2500 wrote to memory of 3040	2500	msedge.exe	146
PID 2500 wrote to memory of 3752	2500	msedge.exe	147
PID 2500 wrote to memory of 3752	2500	msedge.exe	147
PID 2500 wrote to memory of 5460	2500	msedge.exe	148
PID 2500 wrote to memory of 5460	2500	msedge.exe	148
PID 4216 wrote to memory of 5200	4216	MEMZ.exe	150
PID 5200 wrote to memory of 5220	5200	msedge.exe	151
PID 2500 wrote to memory of 5244	2500	msedge.exe	152
PID 2500 wrote to memory of 5244	2500	msedge.exe	152
PID 2500 wrote to memory of 5244	2500	msedge.exe	152
PID 2500 wrote to memory of 5308	2500	msedge.exe	153
PID 2500 wrote to memory of 5308	2500	msedge.exe	153
PID 2500 wrote to memory of 5308	2500	msedge.exe	153

C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe
"C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\5CC1.tmp\5CC2.bat C:\Users\Admin\AppData\Local\Temp\615e94e95ec6d07831fd6e91807dc77da49dd37d19539728d9dfdec3ae39fcc1.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Windows\system32\cscript.exe
    cscript x.js
    3⤵
    PID:8
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3012
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1504
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1068
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1100
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1716
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:4244
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4216
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\System32\notepad.exe" \note.txt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4832
    - - C:\Windows\SysWOW64\mspaint.exe
        
        "C:\Windows\System32\mspaint.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3044
    - - C:\Windows\SysWOW64\mmc.exe
        
        "C:\Windows\System32\mmc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1672
      - C:\Windows\system32\mmc.exe
        
        "C:\Windows\system32\mmc.exe"
        6⤵
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4940
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+buy+weed
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+2+buy+weed
        6⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:2500
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffa36aec188,0x7ffa36aec194,0x7ffa36aec1a0
        7⤵
        
        PID:3376
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,3889620960295252251,10272641554985957534,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
        7⤵
        System Time Discovery
        
        PID:4880
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,3484383464399800630,8225800880192642814,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
        7⤵
        
        PID:1652
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3139761602635551467,8780046708364299061,262144 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
        7⤵
        
        PID:752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,11856005522197001381,11503259062757729873,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
        7⤵
        
        PID:5068
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,11253299087037677706,328379520987040167,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
        7⤵
        
        PID:4168
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,696318229710029873,6185618966864020701,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
        7⤵
        
        PID:2756
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,3398765558381021153,150072127205726480,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
        7⤵
        
        PID:4668
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,15828951263739200863,3504419360105396724,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
        7⤵
        
        PID:2612
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,184833727812454417,12191015207038701611,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
        7⤵
        
        PID:4252
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5428,i,6630382399465539588,12860181255103448257,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:1
        7⤵
        
        PID:3696
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,9852321855549187047,17192624600759109628,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
        7⤵
        
        PID:1272
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2891569078820640243,1728916491417486116,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
        7⤵
        
        PID:1056
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12558963799027205204,11875841527676346450,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
        7⤵
        
        PID:1624
        
        C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,12558963799027205204,11875841527676346450,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
        7⤵
        
        PID:2072
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,2527543045549362829,4626668227061819187,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
        7⤵
        
        PID:2396
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,8143532448110468280,16635250916274360465,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
        7⤵
        
        PID:2752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,4675245008031625562,16325807236560505520,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
        7⤵
        
        PID:3040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,11290806501758694742,16806519057910885978,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
        7⤵
        
        PID:3752
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6111320725489229865,15440281821458336243,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
        7⤵
        
        PID:5460
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5152,i,4869170388066591491,2696188172198806256,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
        7⤵
        
        PID:5244
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6120,i,14077861790341162142,173411686084546823,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
        7⤵
        
        PID:5308
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,13025651064806966343,13768265330115691251,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
        7⤵
        
        PID:5548
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,13475908185634874115,8245779122132645408,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
        7⤵
        
        PID:5588
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,6456602421194380380,15300939842703577819,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
        7⤵
        
        PID:5580
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5304,i,5518126562923381639,15448832722272613131,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
        7⤵
        
        PID:6024
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3680,i,6849948124244506653,7747357208894748202,2097152 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
        7⤵
        
        PID:3016
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,1861458837327431045,3165843785399171544,524288 --field-trial-handle=2460,i,3181372174988630541,15897738775527220507,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
        7⤵
        
        PID:5684
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://softonic.com/
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:5200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://softonic.com/
        6⤵
        
        PID:5220
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
        5⤵
        
        PID:5960
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+to+code+a+virus+in+visual+basic
        6⤵
        
        PID:5948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x504 0x4a0
1⤵
PID:5784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 54e0bc9456a9d12a359f20cc15fc877b5813724876477dfec4f1daabd39570b2
MD5 e577514a240d359d8c4f872f4848fda1
SHA1 9522be8116175117e7d13b29ba823bb4002e09b2
SHA512 b605eed78c0b321ac8a253688e1a3662fc615cdc7a154570635685cb19dce1fec70be1989a5dd812b27cce4a666a1e90780f9774bacb40cbc76712e592c599a3
TLSH
T13F714D3301C940C2DB86013A54F1A244FABD82EAF53FDF4680F76A7E1B93716515A0BB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aabe1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5aabe1.TMP
Size 3KB
SHA256 3ccabf19a69c0d93b5e2e10e30336df48d246c2df304e4f8b7b820534036d7dd
MD5 d78d9649cc2cbbc41605d02c0e25cb1c
SHA1 10b916c4d0a4d4f0f7b377e7defa215ec78f9dab
SHA512 c1d69909c795ed5f666005c88b9ca57ec280a508550afe4e79112cc621c43b3e6940e0332d15415d2dbb8acf672e1c11d9d497a80ebfb447e446246273c0e528
TLSH
T151714E3701C940C2D782053A54F16284F8BD82EAF53FDF5150F76A7E4B93711815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 37d8220a974c9ba4b7fc3e5fe02fa5ccb7d0c349804b5159cdcee2e502d8070c
MD5 d24e8d05655888db21022393516d1080
SHA1 362ae5481b1af362d6942b83ade6f1ec62b3b78d
SHA512 2368863bd82fa66f2fe7887743dacacf19445a1db083036fc71bac072b81eed0b1324c80a485ca30c4d665a187cc425fb75a1ad9645211ee85ebdd6e76112dbb
SSDEEP 192:sxZ6REyM/jK1Ml8MiD/fDsejrqyibXlmIdpVCoHW6+WN8gs/Yz4HsCIg4J:sxZ6GqD/fDswr0JFHbg/Xc
TLSH
T11152E916AA349977CCCBD209B9457B53D6F50562E2940D44AAFCCA0C04E6FED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 ab0a132398d76b8d8ad32fe9e1dad0f7e9f47ce4a0b68965082e7a5c35f2543f
MD5 6e1794b7905a607fc0365faed512756b
SHA1 844299c6e0d89bd0defd49f24e33a8c23af8eaf9
SHA512 4fb192841ddb03af5a53441665b224dfe94415db809c755c8978eb60d29a57f3729644a7263e724c2e9b3c5d98ccc25376b324f6acdb353d1775421fbc1ff3b3
SSDEEP 768:M7W7kAZ7pLuL780Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1ga5LlWYSjHroa:M7W7kAvE780Wvqidau1ja0ga5LA3jUUT
TLSH
T171F2FB3B780CCB7E4F844E9CEC2A6E9A6DE8018B56D8C95487FA844C03C66EB15175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ad0bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ad0bf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fa7b548dadd5c849c9373461a412c7bc26d983e61315d3d211db362912bae7d1
MD5 eb7b438476edda692ccce5ea1d2b5caf
SHA1 9a7f633474292334c8e1d118db39e6345bf58129
SHA512 ac79538c3c8d9f49dfc3dad64e4fa35b8c7e25644dd64bcd37e84d66bdd511055da1093fa4cc1386c5c5acc185608abf24ff8975ce8b6f800c3b7e4a5fc45b2b
SSDEEP 192:uuGLsNKyQgBCHXBxrBb5LQmiU1UO/4aGBPK7hCI9jlEydNNqhf3U8:nssNKyzCvVbbBwbM24if3U8
TLSH
T194422B366CB89D3B5DA6A181F44637036FE4416BE6882F44E2ED6B1C05EB79C131790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 efa662269cd083431ce967eb2dc451b27760913a02e2c32c6aef4d8e90f0ebde
MD5 6ccb1fb730d8a157b50c3d7ce0be0b6e
SHA1 d0f789b957b80735840942a1a3a14ee0f09055f9
SHA512 52d0242f45686ee16d4e35fe1d574c02e004ca122878c076d65063f5408ca3bd18db9f4c3165b99d4db144f8527212734fb41371d524751fdda9afeb9433d16b
SSDEEP 192:MONo64BAQmiUy+1BW5GBPK7hCI9waDpXU6:MONo6eA57WQM5JU6
TLSH
T1CA020A356CB96C7B9EB2AE44F48637172FE8117BF6945B40E6E82B1C00D765C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 92d26c4d6ebfbc427f32a8c3a281dd910141c79d64d3b22f301b244aa7b72b02
MD5 6c9de122a7886f75dcbf506aa2f932b6
SHA1 b003b07fa3e36bd2ceba88d6c73d70578b2ab913
SHA512 a5b1d8a4f9e823f0bff99ac7920dd04140cf4b2484a8f14a822af6ec76156c89b1f6852724a9e442b9a26731ecaf4ff20c8a762974860f7be9e77ff5cd15cbe3
SSDEEP 384:nytNn/s3n9SfsNKH9zCvVbbIh2bM24if3ITGT0Izx9W:yj+9UKwhIz4Ii+0GvW
TLSH
T123928C336C75AD2B5DA2A182F50A37071FF441ABE2C42F44E6ED6B0C04DA7AC1317E0A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 11afac5d4995fee9cabe59cc304258d8bbdc860b991a52ce3cc1a085dc09d906
MD5 00cb10584196303dc334e5684ee9f63a
SHA1 5cd36beeaa41c0e95d68d5f1ed366371a2d6c702
SHA512 f8f8a10b7ef8233463ce5de14b079fc235a8643a2382951c4bbc5336dfb1c30f47399f239a628b1d7c8eda74b9a62941fdc63c6facb7cf746568a68fd3ee9912
SSDEEP 192:bONz64BjQmiUynBw5GBPK7hCI9jlEOWwNqhf3U6:bONz6eVWwQM2Mif3U6
TLSH
T1BE120A726CA8AC6B5DA2A181F48632031FE5416BF6886F40E6DD2B1C05EB65C231791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b83022aee196ba84901dcd5a3fa87421cc3cff33b2a1b222c4d0386a7c021ff8
MD5 1ab48c2353bb261983aa928e3d38996b
SHA1 fe4a274b55d04dd677feb079d97aacfd7854bc2f
SHA512 fc7bf5f56f12c5e120e8f6f33e0c927ca407b1e53a663270d0c46630b4579153429f5329a6b793b88f08fb81ce0b91e3d6634c86132a85c3e1147a6e3adb3615
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5ab2d6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5ab2d6.TMP
Size 392B
SHA256 3a0e769cc058ecd9f84131c1687c68c78a06ddd527ca03d8cb41cf28f84bb735
MD5 78104a036be83577dd0c3d78b06147a4
SHA1 0892756830fd595fdcb549aeeab041d5790f90ad
SHA512 146db9d03ce627827721ef8bda16675d779e1223b08565e2b3574ef57716b05a18869859613d6f10632fcc5f123bb9b9ff3ff33cff7a679b92f4aa6a19ba0b21
MD5 SHA1 SHA512

Submit Download

ed6c48ab-a35b-4ed2-964f-2b03a135614a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed6c48ab-a35b-4ed2-964f-2b03a135614a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 92de793a10b4c2e1464e88cb5acd8a2a14f8cbb090495c0e3c32b688a6a74619
MD5 8791ee87dec2ff379f96045dfe12fb18
SHA1 e3eb4f5a527e1f15eda42cccdf565ae0874b1fdb
SHA512 fcb83c9c6ff2e559b25a9717c211476f85ab6f176a5a0f0a4889ec95b7dc753aa1eaf1ed44fd9a747453dc7d812388432522cab27845b24ecfd832051740a48b
TLSH
T128413A99B6FD1048B3B77E5A9BF6A46D587ABC372F0AD59D00110D4E0A62F40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

4db05bd2-79a4-4b55-b8ca-02a679b98e63.tmp

Path C:\Users\Admin\AppData\Local\Temp\4db05bd2-79a4-4b55-b8ca-02a679b98e63.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

5CC2.bat

Path C:\Users\Admin\AppData\Local\Temp\5CC1.tmp\5CC2.bat
Size 13KB
SHA256 73b1516cf233953836bd4c5964d8246da55fc49d1ec2706405330e9fe108581c
MD5 1932aefc82bd14764a6bcd89efd882bc
SHA1 7267331b12d1094ff2ebc53a8370ecedc8eb7b19
SHA512 75904e3de919417da2174a31ac3f1054a5b27c739f469bd16fa6d7d9bdcd318fb17c8ff06c54119ae79d1b844ace3f723799576b278d2450a80eed0135b49fd0
SSDEEP 192:BOyUySl0UaDz2gWsIzlmj+BxZ3yqueWQx0lZicyC8Sh31xcjBzyxwn7AVhllzYv:BVODaDSHMql3yqlxy5L1xcjwrlzC
TLSH
T151528E3236754E13193326CB5C3AA246BCF4503F361A5E71A4138DFB50AAFD1319EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3799f40-d2b0-4a95-bcda-afaf16305e8e.tmp

Path C:\Users\Admin\AppData\Local\Temp\b3799f40-d2b0-4a95-bcda-afaf16305e8e.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

895969b5-c11f-44c2-b31c-b674f369b0a9.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2500_678596848\895969b5-c11f-44c2-b31c-b674f369b0a9.tmp
Size 152KB
SHA256 f83832c37a0969ce89f77b16eaa07457b03f43029abaec00eaedce2674adbaf5
MD5 d2e80cd29c43ea745d16284dc1f58ea6
SHA1 53fe0165f9f303b333be9284865c8a74f3553c0b
SHA512 375fd3e65b12f80b92a63c1cf6f0ace9fe878c1a0cb5179d869c99aad0cfde14715fd1499eab22a04f353e5f292c19d6a5aeccb43ec2ff5cd6878a5226b005ca
SSDEEP 3072:bHVqfst2F+fBXzSKmg3n0OIH1iCylcLMLgaK9enj59Ah8MuBX8Yk17CF:b1qkfBXG801idlcLMLgaOeV9A2XdBkda
TLSH
T1DBE3E13C3EDACD26C21B20F97F287587C54D8F17A10BA50BE14A84015A76B5E17E2DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2500_983945511\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4652-0-0x0000000000412000-0x0000000000413000-memory.dmp

Download