killmbr | 35f879dac4810237bf23a7fe7fe78af1fbf65708250b1e43d9e0146837d323a0

Resubmissions

28/06/2026, 07:21

260628-h65easf19p10

28/06/2026, 07:17

260628-h4wdlsfz7v10

28/06/2026, 07:16

260628-h38mjsf18q1

28/06/2026, 07:16

260628-h3ttdsf18p1

Analysis

user interaction
yes
max time kernel
704s
max time network
473s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 07:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
XanderLeakedFace.classiefied.ZIP.7z.Tar/real vortex.jpg
Size 95KB
Sample260628-h65easf19p
SHA256 35f879dac4810237bf23a7fe7fe78af1fbf65708250b1e43d9e0146837d323a0
MD5 cc35f4531dbec5792e0599da14d6e897
SHA1 0f8715ca01c518feb61182f1aae94ac766f6d475
SHA512 d97b945ca4365f1cbe1f2e08ad643bf58e144f639688b537ad20b84b7d1e175550d53c9ad3f845c558c8ab4aca955620a16d6210e2fe3b3c281f0c3ed8a52860
SSDEEP 1536:TbaaumSiEADas5AISAgM1aktUMXAnIA3SG1jgCVMWimnZu0JgDyA4nHwb7Xowu8v:JxSiXualgAazeAnhSQtMf0u1DGyXRf8G
TLSH
T18DA3124EEF59DE0F1AEC0B7FA905DD3925AEF111868293C928B24C42B474A712C7B49C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit defense_evasion discovery killmbr persistence ransomware trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x000500000001b9f8-1586.dat	family_killmbr

Downloads MZ/PE file 12 IoCs

flow	pid	Process
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe
133	796	chrome.exe

Executes dropped EXE 12 IoCs

pid	Process
6568	MEMZ.exe
6916	FreeYoutubeDownloader.exe
1992	LoveYou.exe
240	Free YouTube Downloader.exe
3040	MEMZ.exe
2072	MEMZ.exe
4512	MEMZ.exe
5268	MEMZ.exe
2412	MEMZ.exe
2940	MEMZ.exe
2340	FreeYoutubeDownloader.exe
4108	PCToaster.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5144	takeown.exe
6496	takeown.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000\Software\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
12	camo.githubusercontent.com
133	raw.githubusercontent.com

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	mountvol.exe
File opened (read-only)	\??\S:	mountvol.exe
File opened (read-only)	\??\T:	mountvol.exe
File opened (read-only)	\??\X:	mountvol.exe
File opened (read-only)	\??\Z:	mountvol.exe
File opened (read-only)	\??\A:	mountvol.exe
File opened (read-only)	\??\K:	mountvol.exe
File opened (read-only)	\??\Q:	mountvol.exe
File opened (read-only)	\??\R:	mountvol.exe
File opened (read-only)	\??\W:	mountvol.exe
File opened (read-only)	\??\O:	mountvol.exe
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\B:	mountvol.exe
File opened (read-only)	\??\D:	mountvol.exe
File opened (read-only)	\??\G:	mountvol.exe
File opened (read-only)	\??\H:	mountvol.exe
File opened (read-only)	\??\J:	mountvol.exe
File opened (read-only)	\??\P:	mountvol.exe
File opened (read-only)	\??\U:	mountvol.exe
File opened (read-only)	\??\Y:	mountvol.exe
File opened (read-only)	\??\L:	mountvol.exe
File opened (read-only)	\??\M:	mountvol.exe
File opened (read-only)	\??\N:	mountvol.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Google\Chrome\Application\debug.log	chrome.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\debug.log	chrome.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PCToaster.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LoveYou.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mmc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FreeYoutubeDownloader.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
796	chrome.exe
5496	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
5796	taskkill.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134271049389776528"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Moniker = "cr.sb.odm3E4D1A088C1F6D498C84F3C86DE73CE49F82A104"	chrome.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3246620872-1649211507-2285877732-1000\{01C36A6D-27AC-4EC5-B5B9-C0A16AFBABC4}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3246620872-1649211507-2285877732-1000\{90010779-FC65-45D4-93E4-2D7285011659}	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-3246620872-1649211507-2285877732-1000_Classes\Local Settings	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	MEMZ.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3764	mspaint.exe
3764	mspaint.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
2484	chrome.exe
2484	chrome.exe
3040	MEMZ.exe
3040	MEMZ.exe
3040	MEMZ.exe
3040	MEMZ.exe
2072	MEMZ.exe
2072	MEMZ.exe
2072	MEMZ.exe
2072	MEMZ.exe
3040	MEMZ.exe
3040	MEMZ.exe
5268	MEMZ.exe
5268	MEMZ.exe
4512	MEMZ.exe
4512	MEMZ.exe
5268	MEMZ.exe
5268	MEMZ.exe
3040	MEMZ.exe
3040	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
2072	MEMZ.exe
2072	MEMZ.exe
3040	MEMZ.exe
3040	MEMZ.exe
5268	MEMZ.exe
5268	MEMZ.exe
4512	MEMZ.exe
4512	MEMZ.exe
4512	MEMZ.exe
5268	MEMZ.exe
5268	MEMZ.exe
4512	MEMZ.exe
3040	MEMZ.exe
3040	MEMZ.exe
2072	MEMZ.exe
2072	MEMZ.exe
2412	MEMZ.exe
2412	MEMZ.exe
2072	MEMZ.exe
3040	MEMZ.exe
2072	MEMZ.exe
3040	MEMZ.exe
4512	MEMZ.exe
5268	MEMZ.exe
4512	MEMZ.exe
5268	MEMZ.exe
5268	MEMZ.exe
4512	MEMZ.exe
5268	MEMZ.exe
4512	MEMZ.exe
3040	MEMZ.exe
2072	MEMZ.exe
3040	MEMZ.exe
2072	MEMZ.exe
2412	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
6060	mmc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 24 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
6260	msedge.exe
6260	msedge.exe
6260	msedge.exe
6260	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe
Token: SeShutdownPrivilege	5972	chrome.exe
Token: SeCreatePagefilePrivilege	5972	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
240	Free YouTube Downloader.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe

Suspicious use of SendNotifyMessage 22 IoCs

pid	Process
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
240	Free YouTube Downloader.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
5972	chrome.exe
240	Free YouTube Downloader.exe

Suspicious use of SetWindowsHookEx 33 IoCs

pid	Process
3764	mspaint.exe
3764	mspaint.exe
3764	mspaint.exe
3764	mspaint.exe
2820	javaw.exe
2820	javaw.exe
2820	javaw.exe
2820	javaw.exe
4988	mmc.exe
6060	mmc.exe
6060	mmc.exe
5972	chrome.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe
2940	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 6700	5972	chrome.exe	95
PID 5972 wrote to memory of 6864	5972	chrome.exe	96
PID 5972 wrote to memory of 6864	5972	chrome.exe	96
PID 5972 wrote to memory of 796	5972	chrome.exe	97
PID 5972 wrote to memory of 6988	5972	chrome.exe	99
PID 5972 wrote to memory of 6988	5972	chrome.exe	99
PID 5972 wrote to memory of 6500	5972	chrome.exe	100
PID 5972 wrote to memory of 6500	5972	chrome.exe	100
PID 5972 wrote to memory of 476	5972	chrome.exe	101
PID 5972 wrote to memory of 476	5972	chrome.exe	101
PID 5972 wrote to memory of 6832	5972	chrome.exe	102
PID 5972 wrote to memory of 6832	5972	chrome.exe	102
PID 5972 wrote to memory of 7124	5972	chrome.exe	103
PID 5972 wrote to memory of 7124	5972	chrome.exe	103
PID 5972 wrote to memory of 6616	5972	chrome.exe	104
PID 5972 wrote to memory of 6996	5972	chrome.exe	105
PID 5972 wrote to memory of 2972	5972	chrome.exe	106
PID 5972 wrote to memory of 6996	5972	chrome.exe	105
PID 5972 wrote to memory of 2972	5972	chrome.exe	106
PID 5972 wrote to memory of 1492	5972	chrome.exe	110
PID 5972 wrote to memory of 1492	5972	chrome.exe	110
PID 5972 wrote to memory of 6876	5972	chrome.exe	111
PID 5972 wrote to memory of 6412	5972	chrome.exe	112
PID 5972 wrote to memory of 6876	5972	chrome.exe	111
PID 5972 wrote to memory of 6412	5972	chrome.exe	112
PID 5972 wrote to memory of 240	5972	chrome.exe	113
PID 5972 wrote to memory of 248	5972	chrome.exe	114
PID 5972 wrote to memory of 240	5972	chrome.exe	113
PID 5972 wrote to memory of 248	5972	chrome.exe	114
PID 5972 wrote to memory of 3060	5972	chrome.exe	115
PID 5972 wrote to memory of 1728	5972	chrome.exe	116
PID 5972 wrote to memory of 1728	5972	chrome.exe	116
PID 5972 wrote to memory of 3060	5972	chrome.exe	115
PID 5972 wrote to memory of 2796	5972	chrome.exe	117
PID 5972 wrote to memory of 2796	5972	chrome.exe	117
PID 5972 wrote to memory of 4812	5972	chrome.exe	118
PID 5972 wrote to memory of 4812	5972	chrome.exe	118
PID 5972 wrote to memory of 7088	5972	chrome.exe	119
PID 5972 wrote to memory of 7088	5972	chrome.exe	119
PID 5972 wrote to memory of 6480	5972	chrome.exe	120
PID 5972 wrote to memory of 6480	5972	chrome.exe	120
PID 5972 wrote to memory of 4524	5972	chrome.exe	121
PID 5972 wrote to memory of 4524	5972	chrome.exe	121
PID 5972 wrote to memory of 4508	5972	chrome.exe	122
PID 5972 wrote to memory of 4508	5972	chrome.exe	122
PID 5972 wrote to memory of 2880	5972	chrome.exe	123
PID 5972 wrote to memory of 2880	5972	chrome.exe	123
PID 5972 wrote to memory of 3156	5972	chrome.exe	124
PID 5972 wrote to memory of 3480	5972	chrome.exe	125
PID 5972 wrote to memory of 3480	5972	chrome.exe	125
PID 5972 wrote to memory of 6980	5972	chrome.exe	127
PID 5972 wrote to memory of 6980	5972	chrome.exe	127
PID 5972 wrote to memory of 3044	5972	chrome.exe	128
PID 5972 wrote to memory of 2012	5972	chrome.exe	129
PID 5972 wrote to memory of 2660	5972	chrome.exe	130
PID 5972 wrote to memory of 2672	5972	chrome.exe	131
PID 5972 wrote to memory of 2672	5972	chrome.exe	131
PID 5972 wrote to memory of 4604	5972	chrome.exe	132
PID 5972 wrote to memory of 4604	5972	chrome.exe	132
PID 5972 wrote to memory of 4352	5972	chrome.exe	133
PID 5972 wrote to memory of 4352	5972	chrome.exe	133
PID 5972 wrote to memory of 2484	5972	chrome.exe	134
PID 5972 wrote to memory of 5948	5972	chrome.exe	135
PID 5972 wrote to memory of 5588	5972	chrome.exe	136

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
5392	attrib.exe

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\XanderLeakedFace.classiefied.ZIP.7z.Tar\real vortex.jpg"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
- Checks SCSI registry key(s)
PID:7008

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffb83a9c728,0x7ffb83a9c734,0x7ffb83a9c740
  2⤵
  PID:6700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1632,i,7387144683758278787,5099464407064297500,262144 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=1852 /prefetch:2
  2⤵
  PID:6864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2164,i,12191152513812647172,16933203320828479434,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2344,i,17251978437998544214,7099693620871979908,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:13
  2⤵
  PID:6988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3244,i,7843096583330189837,4926499695920285791,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:6500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3232,i,6288450663118901295,2129339132825285232,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4704,i,4490744504350263347,16215815162060980569,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4892,i,2753258360330373385,10297580866576922846,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=4880 /prefetch:14
  2⤵
  PID:7124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5404,i,13230630125779918160,10794211437059429470,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:6616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5472,i,9958823777591466208,15349028119384647887,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:6996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=5512,i,3438803573565874171,2485469638807322860,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5836,i,8960242052014081507,6979133568209648058,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5976,i,2016808899662742510,1878497081483384741,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:6876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,11175232531606399127,1410748994982330280,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:6412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5732,i,12688810520234283970,8620948660393941450,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:240
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5552,i,10381475388821295890,368300625460591769,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=5536,i,4317005038193846799,7766989394549852588,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,2606122022589106602,8255707823205825056,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:1728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5428,i,822004794625646195,931578790609449459,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4844,i,9033532029141430149,6126129047870578909,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6232,i,8741740245360413947,9708064690016183420,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:14
  2⤵
  PID:7088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4764,i,17963677034231659929,2231842438396469917,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:9
  2⤵
  PID:6480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6204,i,16348026847105026129,7103744797543815697,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5732,i,159076000553304477,14004226981212048682,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5688,i,14270984386390391649,3071051567908716089,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5716,i,19062285828021123,8866007642450639620,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6552,i,17040741819726078653,6647766634253069150,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:12
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=4744,i,7366568189930575184,7301157428672556274,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,10573783529568240631,16866838489001968031,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5992,i,6772876932777187914,4316885434653464411,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:14
  2⤵
  PID:2012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6488,i,11565236104672921928,9337718689803781484,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:14
  2⤵
  PID:2660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6188,i,4885500626507870737,4081213199004801053,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=6128,i,4696881405986033624,8169592259425531173,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=6276,i,14534555162267470324,12603659104043403391,2097152 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6748,i,17225105213279769276,10044748480604736254,262144 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=1196 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7116,i,18345917773366985146,6341656324696866081,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4584,i,3571864782747485031,13747537535889942843,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=7132,i,13735896888277848642,7488527673458686512,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=7148,i,7434059957193478862,18039125629029641163,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:14
  2⤵
  PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3568,i,11159727924484482238,3350008587285365038,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=6936 /prefetch:14
  2⤵
  PID:5620
- C:\Users\Admin\Downloads\PCToaster.exe
  "C:\Users\Admin\Downloads\PCToaster.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4108
- - C:\Program Files\Java\jre-1.8\bin\javaw.exe
    "C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\PCToaster.exe"
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2820
  - - C:\Windows\SYSTEM32\attrib.exe
      attrib +h C:\Users\Admin\Downloads\scr.txt
      4⤵
      Views/modifies file attributes
      PID:5392
  - - C:\Windows\SYSTEM32\diskpart.exe
      diskpart /s C:\Users\Admin\Downloads\scr.txt
      4⤵
      PID:5468
  - - C:\Windows\SYSTEM32\takeown.exe
      takeown /f V:\Boot /r
      4⤵
      Modifies file permissions
      Enumerates connected drives
      PID:5144
  - - C:\Windows\SYSTEM32\takeown.exe
      takeown /f V:\Recovery /r
      4⤵
      Modifies file permissions
      Enumerates connected drives
      PID:6496
  - - C:\Windows\SYSTEM32\taskkill.exe
      taskkill /im lsass.exe /f
      4⤵
      Kills process with taskkill
      PID:5796
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol A: /d
      4⤵
      Enumerates connected drives
      PID:5352
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol B: /d
      4⤵
      Enumerates connected drives
      PID:5492
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol D: /d
      4⤵
      Enumerates connected drives
      PID:5876
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol E: /d
      4⤵
      PID:996
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol F: /d
      4⤵
      PID:5356
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol G: /d
      4⤵
      Enumerates connected drives
      PID:4124
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol H: /d
      4⤵
      Enumerates connected drives
      PID:1216
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol I: /d
      4⤵
      Enumerates connected drives
      PID:1380
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol J: /d
      4⤵
      Enumerates connected drives
      PID:4432
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol K: /d
      4⤵
      Enumerates connected drives
      PID:6724
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol L: /d
      4⤵
      Enumerates connected drives
      PID:2260
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol M: /d
      4⤵
      Enumerates connected drives
      PID:6780
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol N: /d
      4⤵
      Enumerates connected drives
      PID:7100
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol O: /d
      4⤵
      Enumerates connected drives
      PID:988
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol P: /d
      4⤵
      Enumerates connected drives
      PID:4836
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol Q: /d
      4⤵
      Enumerates connected drives
      PID:5984
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol R: /d
      4⤵
      Enumerates connected drives
      PID:4552
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol S: /d
      4⤵
      Enumerates connected drives
      PID:1604
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol T: /d
      4⤵
      Enumerates connected drives
      PID:5576
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol U: /d
      4⤵
      Enumerates connected drives
      PID:3020
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol V: /d
      4⤵
      PID:5484
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol W: /d
      4⤵
      Enumerates connected drives
      PID:5920
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol X: /d
      4⤵
      Enumerates connected drives
      PID:5360
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol Y: /d
      4⤵
      Enumerates connected drives
      PID:2284
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol Z: /d
      4⤵
      Enumerates connected drives
      PID:3964
  - - C:\Windows\SYSTEM32\mountvol.exe
      mountvol C: /d
      4⤵
      PID:5536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5548,i,14890284942483339050,4142863422368568020,524288 --field-trial-handle=1860,i,4676550232183240681,16043071043990542481,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:14
  2⤵
  PID:956

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1928

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:384

C:\Users\Admin\Downloads\MEMZ.exe
"C:\Users\Admin\Downloads\MEMZ.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6568
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:3040
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2072
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4512
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:5268
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /watchdog
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2412
- C:\Users\Admin\Downloads\MEMZ.exe
  "C:\Users\Admin\Downloads\MEMZ.exe" /main
  2⤵
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2940
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+to+download+memz
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    PID:6260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x310,0x7ffb69b3c188,0x7ffb69b3c194,0x7ffb69b3c1a0
      4⤵
      PID:2548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,1707129544421132425,13742988540709780935,262144 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
      4⤵
      PID:1976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,11020826985358325409,17243903194919829897,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:11
      4⤵
      System Time Discovery
      PID:5496
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,15930788994508229150,5416472415145389748,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:13
      4⤵
      PID:2028
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,11979544875531912297,13865433828486601480,2097152 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
      4⤵
      PID:4508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,4347192490979542400,204542942231136341,2097152 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
      4⤵
      PID:692
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4948,i,15369130602563766350,16160395042218407358,2097152 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:1
      4⤵
      PID:4556
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,7882060159865860260,7270378836220458745,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
      4⤵
      PID:4628
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4052,i,5616177502056627351,1773607028427401331,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
      4⤵
      PID:4968
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,774885236790382563,17626829103547948588,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
      4⤵
      PID:3720
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3036,i,15374522794023943644,12014685382933170412,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:14
      4⤵
      PID:1712
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,17892833055098842489,12935211085819427960,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
      4⤵
      PID:1920
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16774996997531214409,5897049271251377684,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
      4⤵
      PID:1784
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6891451902550424254,14699954372301422238,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:6736
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6891451902550424254,14699954372301422238,524288 --field-trial-handle=2300,i,10084590111580103816,3469076554943998745,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
      4⤵
      PID:628
- - C:\Windows\SysWOW64\mmc.exe
    "C:\Windows\System32\mmc.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4988
  - - C:\Windows\system32\mmc.exe
      "C:\Windows\system32\mmc.exe"
      4⤵
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:6060
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4768

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6916
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:240

C:\Users\Admin\Downloads\LoveYou.exe
"C:\Users\Admin\Downloads\LoveYou.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2732

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1180

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c693e4c-8b92-4121-b20e-30360f2be8dc.tmp

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2c693e4c-8b92-4121-b20e-30360f2be8dc.tmp
Size 13KB
SHA256 d553b0b25e85391bf64ba8d2bda435a2dbaf0563a52ad7eb59ad318bd8cd6c06
MD5 cbad28bbaeaa2e7fafae04414cf5d89c
SHA1 47946e77a48308f247dc4e20adb0d4642f426bf2
SHA512 48f208c1ee245729c208cf7edf3cd3a3e8396534f6c973b095988600a74f964681d390acd86c726815ed92f8611bc9b4ebae3486391a6730641cf8aa34ac8ea7
SSDEEP 384:NR8mhKKjErsfEcuDazvduUVdX4yOwt0Q2i2ecOE:UmhKKPdayOwwi2ecd
TLSH
T15B52965FA910397BACDBD629F965B75AD2F5107172D02E80EAFC8B1C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000022

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000022
Size 21KB
SHA256 42d4e8f1a0d2f0529ef1bedd2e9652c257f3244f1f008deb9360694f09afadb3
MD5 e677f3a0ad6e120a1000c5ca6be38f98
SHA1 2077b8f2880ff8c33a9380e4aeaff6902266484c
SHA512 a15611104ebcdb197b597c4cab3221abdc9ae28986e5dcc6a1749c8ea77ce8a0869161c1ce93e7563be2ee10f08d3d0bad0915e33224f3bcc209047af6017c36
SSDEEP 384:xxIa86wNeXcY9R1K/2zASArFAsz1KE0/rg+N2eRYYy2VAWJflJdg0vpVON/le24f:zOne1D1K+6FAsz1cv1YYy2V3JflA0vpF
TLSH
T13DA2E1C161EA9F7A8A614481BF1493E3425C5FB86F34D981B143C7C74150267BEACF4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00002e

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
Size 382KB
SHA256 08f017e768de5ecb50d85084d02d3429eb601b5063df82294db8de21e5a83de3
MD5 6c5db763285f66af7345428e5d5d33d0
SHA1 7f9c08a399924c783dae4fa2532a12fae428d84b
SHA512 79f7e76e05249ba17288c0b5bf78e95f9512896c91d9ae5eb15693dcca56b4daeb4c6dbd8220d2f0fbef1b41bdfcb5540e774e69c02fd297ac99267342a9dd97
SSDEEP 6144:jLVvBTTNwoBhVgzDqRJHRJqwJiG8VouU7dwK54Ns5pTuYKBBq9DXRK:jLVBTiCVgoxviGtuUuK5DpP+I9c
TLSH
T1FA84239F4BCFA358AF419E03383C309677E3F71252E912CAB624490FA6E1521D4B967D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6f5e9ee3692579b3e3e4d93d6c6c2b6c9c39d077c67650bfd9899a033b3c923b
MD5 4eb544dcb3caf5564315dbd72eec7e79
SHA1 b4a94c07e76936ff565c2bd63272a539dce2ab70
SHA512 e2473a93124817264c4361b1efe4503ebc854da08e9bd0b6935aba27c6764a17efffa039493f34c320f6b132b94f4789c4f51a3a8fecd44e366aa4bbc248fee1
SSDEEP 96:JSQIeBS/oySlCM4dlgDsZvTqA19SQxkMVlSW3nWMx4PWl4LPt4iUTJL9Gn2g01CU:JSQIkGovCM4dwsZvTqI9SQx5WqXaPWlz
TLSH
T120C1CB18595901ACEF98793317C6943DF372268769472FAA73C494BB1A82FF053E8C6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 2a2693a7e0ee093ba28a9ab524f4015418d191a66c463465fb96672fbfa66529
MD5 ac55177d95e5332fbe2589e128620e5b
SHA1 2ea9a4acfb7d3cc39ed50e6faa25d141661d3bd8
SHA512 26f7e9f758a323d35a2e53f32738c4cd97ef63813a2e78660be87669e017ad53ed2715c0b5ee5c544397dcc52aa716eb42031eb122b472f7e8812a278c21da63
SSDEEP 96:eaoeMnY/CKm2gCKdiJsZbtiZAB9iB1io3nWn4VhMFxOieL+sl9Gr2E0wCpnQ9tc8:eLeM8DOCKdiJsZbtiZo9iB3LVhMFoi2k
TLSH
T1BCB1FD95B91A51F8FF81793314CB042DFBF27941890A2B19338085F92F82F70639BC68
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 93KB
SHA256 35d20b0f38da1cafe021993a4b41dd78f0694e8a747d8d7d168eaecf27967125
MD5 f67a9e8ab280d916af927a0305b80224
SHA1 d8506f8ff7094fb0ede38a7306ec2c2756afce25
SHA512 fc70297cb1be456e96a72e5613636a8c9bf0f0e01c8cb36c95adb67531b340ca752f6d86350d4a0c068168a002adf54c077ac41766b04b0477f314d118b4aca0
SSDEEP 768:+1CoM1CV3zrdlJ421c5nj2wZ+nCAyX99pA955CAyPo105CAyXlZn:u3Xsj5AnCAyNw5CAygq5CAyj
TLSH
T17593220C5BA86C134BE74A1668F138DD8862B72D6044DC7A942D2DBB0BFEFF19109767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 eb12bd24ca12d6d9d2b4473633c4edc190c068f81e47e889f44e02fd60ed5464
MD5 1de39032c042a3df1d9479adca7c78f9
SHA1 bf6f9e2c562cf9102fecfc15cc229cae9bfbf44e
SHA512 98baaca73b271d2fbbc44378d66dbda4b956e211060b28fc4b4f9ed5d7a40c5e103c8a865af1c11ebd3b1d25e77a176c8f3a84e837743425938eb10e724b87ad
TLSH
T1ADE0DF68E4CAC6AF115480B69D347F0ECBA2250CEBDDADCE0F03D828B0C640895ED361
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f4a4fcb0895928a0c1ae3ed116d137e3c6811afcea9f7d02b757d4e581227999
MD5 df2b8f97f2e7fbf85c72b8478c43f015
SHA1 448a4a65e500218d3ef6a0a1ccfef79beb2971db
SHA512 360b53692cabd06e8d44cb6294ac6d4878aa1b24d45d4b12d5e4aed96cd124c5a994838415531b0eb3fd9458baeea289e5e8a851d34e90705ba969b4aa9e9ffc
SSDEEP 192:Dnfwbld0+p4SuJVLuJmRmX/59/xioVQ/daPnt2u/exvs/fPbNPjIrIrIb9MICbBD:Dnfwbld0+p4SuJVLuJmRmX/59/xiyQ/W
TLSH
T16D22AEF7C7D9C62DC91116F4AB25AF1ECE290924431D3C26C8D8BF5AA3E2872D21535E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 16a96dd6e668026559448faf2e32ea0e348a6c810d8c5bfbf638048fa495c91a
MD5 87caea8fbd2a96464ffddffb734ed6ef
SHA1 5bd1a95ae23215133443ae2f7035c517a5e04ec2
SHA512 16dcc23a52fd32aa6dd72d675447d4f652a77f0af92ac29966ae0d5d3e93d5abdd86b54c96d110b973941dd42b0311d0287f851140bcc3d1a1d13d39b27beac4
SSDEEP 384:Dnfwbld0+p4SuJVLuJmRmgYN4Fdei/59/xx/da/tTIoNNKm0WwIqCNCfFPpNBKDL:/aYgy4+2RslOflnZiqS8H
TLSH
T17452BEF7C7D8C62DC90116F4AB25AF1ECE191A28431C3C66C8D8AF4BA3E2871D21574E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 a6aaad4d39d0dc39e3a0bfffbb28a42a386ad8a8484acb21e81b96d724cd95a1
MD5 1d4246d8da88e4f1b915dd51a0afac2c
SHA1 f9628d8acd2f1301682eb0aff9c4671488a86944
SHA512 ebf83b9f4d68532a548e59a38b4d5e505dc7380358b913a0ad36bc1c132a48926c38261ee17a418368c4c6b4d451e75d166dfae4ef97537784884711ecdf5319
SSDEEP 384:NR8mhkKJErsfEcuDazvduUVdXSOw2Bw2l2eCOE:UmhkKhdwOwOl2eCd
TLSH
T1E852B75FA910397BACDBD629F966B71AD3F5107176902E80E6FC8A1C01EBACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 140c1adfaa5c363f5f0fa6a113b433cd0d121ceda4e8eb1c788663fadab0c84e
MD5 943dae4da0f3e0f23717346de82ba00c
SHA1 699d91fb6cd485b98c1b5f837397fc4d7232d4bf
SHA512 8a5658f685df7c72ecbc66e1873a59d843f783abcaf67f3876fa6143146b604d987c0c016cb81d61624c8d607acb679775c9ba9d238036e3002ca6e401039864
SSDEEP 384:NR8mhUKjErsfEcuDazvduiVdX4yOwtko2l2ecOE:UmhUKPzayOwgl2ecd
TLSH
T19852A66FA810397BACDAD629F965B75AD3F1107172D02E80E6FC8A1C05EBACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 bd398663484cfd152b86a2081486cfd71c91b5955f1c1c945f32ecc4f9850d0a
MD5 aa4b26dac1b33dac9023cc8d38e1181b
SHA1 83f5a13e3c7daf2efcd6295a250dff51a64bf4ad
SHA512 7522e72a575073b8bf4c1a724192589dfb28eed2714381eba1ac1125f6ac42a381c6827115f2bceb3bd2d3d13193304df404e4110705f854e5d63ce4799248bb
SSDEEP 384:NR8mhZKjErsfEcuDazvduiVdX4yOwt0k2M2ecOE:UmhZKPzayOw4M2ecd
TLSH
T1D952965FA910397BACDAD629F965B75AD3F5107172D02E80EAFC8E1C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 41cd72c9043a889406b10bd0c3706f9a788a889d5a92f2a4a503ff4804184d8b
MD5 36e28924922dfb1d9dc3b7e4d4983eff
SHA1 3ee9e41a128965e3c2a0416d8ac3bcc92773cb8c
SHA512 67cac6096abf4006db88dae5a2db05c3b5c9ae30de64f81bfac1c087bb9a613e88a520bec54019f956ff4126f2a62487a8f76e3e24ab4b9e5862912915139953
SSDEEP 384:NR8m8kKJErsfEcuDazvduUVdXVOwEBC2S2ecOE:Um8kKhd7OweS2ecd
TLSH
T14552A75FA910397BECDBD629F965B75AD2F5207176D02E80E6FC8A1C01EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 c35afa50cc2445ecde3bf25342488b167f8f7096ab07d5a64d6814046f695e83
MD5 e40c81c13a70bbd60c2e0e9dae5deec5
SHA1 a158b8237992bb219404e9b08a95f4b7756ab6aa
SHA512 2b4bbce5ca2296f12316fe3c00ce13cd12cf7771dad2603959a2face45205e96574f015a945cda8248e799f7263c801974be34c9e87cf6d569ff22100f240d79
SSDEEP 384:NR8mh/KjErsfEcuDazvduUVdX4yOwtT442F2ecOE:Umh/KPdayOwJOF2ecd
TLSH
T1BD52A75FA810397B9CDBD629F965B75AD3F5107176D02E80EAFC8A1C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 fc9e2e0e76220e51130de124d5678ebfb46c6d416cccfb7df36e16fd294d22fe
MD5 af279127a6dba3a38ac169cfbd7ebfef
SHA1 b6557119885d7e7294a6a73b9671b393216e1b3d
SHA512 a1e0673c40e11297d7033421441dd07b222d0b3240501de39da2750074da5a209177d682e20a16b1a3225812e55dfe92bb5b5470c2c212c5c3b0d85aa444f147
SSDEEP 384:NR8mhUKjErsfEcuDazvduUVdX4yOwtgK2U2ecOE:UmhUKPdayOwiU2ecd
TLSH
T16B52A75FA810397BACDBD629F965B75AD3F5107172D02E80EAFC8A1C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 6492a248fd1989e34a51947f208a2de9cb124a29db9c4cb1841b2a37d822d0d0
MD5 dedfef1e4d38ebf29778ed2343c5a8ce
SHA1 f5dacf206954cf9b81c6658f985bcccb1eee1a60
SHA512 9b80d9df3bb4fdd15d01288342a84e4b0fb1b00a69898d6816017c2d77bdbe2879e588bab8eaa0f03fe54efa74263b365c5f9a4aeb2c2933b0123697cee50a83
SSDEEP 384:NR8mhkKjErsfEcuDazvduUVdX4yOwtBC2S2ecOE:UmhkKPdayOwtS2ecd
TLSH
T15452975FA910397BACDBD629F965B75AD2F5207172D02E80E6FC8A1C05EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 a8d4ed44e735c80e28f0a54aa24ec7caad78e795cb4b2664c2b69482957b6444
MD5 a691fd48f0929ed39ba616d31ff7cc85
SHA1 24cc243bc1c3c6a6567e7a292e6d35eb81150746
SHA512 d793a258ad954dc2d8862b4b6a05522fbee6b407ffc22f0ca14117751ed95e6dce433b5944f83d72d6d8e7b94e4878debc4eba65a233a64fa6521a1d1c85987d
SSDEEP 192:NR8cBzkK8MXErsfEcuDazvduIv7ZAPRp2b3P94Hsb+WNnvd4rp27jev2eoK2VyIy:NR8mzkKJErsfEcuDazvduUIXyOw1K2SJ
TLSH
T18442A62FA910753B6CDBD629FA667757D6F5107172A02E80E6FC8A2C11EBACC3217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 5e28a9a32e0bb6156d71f56f3459e6d67329d488f23e4dde869174e0a6c7d198
MD5 66c56ecee83d73ccb268c116af285887
SHA1 1397fd010f177d87edd3f628309bd029e0bd87ec
SHA512 955011c8788c3318fa284d13db6037ee5a7cebb9e66449148fc39c338e8eb337ffddc465c95338827123a183081728dbff3274bb09517172793617cbabfc60d8
SSDEEP 192:NR8cBhkK8MXErsfEcuDazvduIv75lAPRp2bBQ994Hsb+WNnvd4rp27jev2eoK2Vi:NR8mhkKJErsfEcuDazvduUVQXXOw1K2i
TLSH
T1DD42A52EA910753B6CDBD629FA66B757D6F5107172942E80E6FC8A2C01EBACC2217017
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 d7ae310fceb0766e35b5f385391d853b61973e4da575ed3b0569fa0b91a03124
MD5 d1d3fa381ab3e917b9c194236d23c64f
SHA1 ad74a637953680c52058d07b0932f1e0463befec
SHA512 6a82a1e118e85d4b5a1f8ff44dd92ad884ad124e2bb8ccfd0a1bdd6ae0afec384e548ccf9959ab6bc1ebb0c69d4dc26b37380ff57380e15f62b945c086e13d84
SSDEEP 384:rpjAj7KxkXqKf/pUZNCgVLH2HfgslCIXODfG+ErU3hVHGthn2:rZAj7KxkXqKf/pUZNCgVLH2HfgskyOzV
TLSH
T1E752E727644C963B0F98DA88DC267B4FACB5025B76784D2896FA5C1803D97CE114B2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 cada8116473d2b029bfb8c325477730b011f23121d7d2df595521d8fa9c4db98
MD5 040718919e4dce3c47d554098611d748
SHA1 55f93fe8ec71be46943cd74dd5cf38cc6b0fe1ea
SHA512 a00b0cd234f6786b75b3f765369e18b649dd8e293abf6eaa221e29e35573814cf18c50df42aa50e18ad5dd74ae8038e7a466ad83c8831bfe3c53c758af2887f2
TLSH
T1D6A0029512D11961CC854273138652E0633698981F46C617D3E42A44C856A566245314
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 810f550d5e8f1f562b1ae8c6a27242530dd383d44f270f772625b5abb4fc9e93
MD5 ee78255ee9aa9c6ddce4b39ff31ae9f4
SHA1 40e67e53f950684f76a70aee6b1ba13326fccdca
SHA512 64565ff29c026ebe20fdfb68c2bdea70df9f53b4272e1dc07a4fcbf618a4bc414723ecbf17147d23fc60b9d93b353b6845e7e62adbbd8131c197ab5e1ebed8a4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 dde3a67ed7b612ce33b7794a030db06d8adafc87f7860db90a747f276ec2c92a
MD5 67fe866ffebd4187bfcaa0e1f7f10864
SHA1 4322c0b2f5404adfe0ffe80280cbf7716ff45231
SHA512 1ac6571e42de934da886836aa4d7864a0f649ff5f4126c436295b2d1f178ed9d0c03fd65dffe244f3722f24c76068d555203a9145bfde964df87948686a405b3
TLSH
T143A0021C52C41512DD004BB669A32957277168545E52630B54D14488C85F5C05601151
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 157B
SHA256 a0006221b08bc19c05d8b3cb67238a779e409157c16e21c653871fdef57be584
MD5 0febfb90dd140bfd141093ffb5a2b076
SHA1 aa1b711e2e2a9e4503e45cd7c9cb42cbe901133c
SHA512 6cb71cb7e2f02c78d4ec00e87901550164c5a01e1c0d8a342bdf32bfbd2047f45476c441547b5d389580701f26a6202c49b2a169f39abfb2e4ff721349c5d44a
TLSH
T1B3C08CE32510418B877098CB6128361DD1278F588CCCCCEC844A700220B4E334444528
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 150B
SHA256 585429981b481ac2147398abad613976afdd4685018022ecd9c919b6d57b33a2
MD5 0ec3f26e9c78669c94cfa216fc05ab50
SHA1 5512bbd6c7af68994704e7ececf686cef606b760
SHA512 24feab7c18d84ed5119b8be8cba5a56f91591b193049a0ce2a58ce55506f199bce80dcaee18ab1f9c7310b77e59418ebb86756a9585dfa7f796367ffd0857565
TLSH
T1DDC08CE72500808F87709DDA2118322DE11783488CC8CCEC8449500210B4E330441528
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 8e7c70f70c4a10dd94a6e6b74de4f50a46df6255e3f6ad5c7de466eb32a13525
MD5 29d0e97019a7835d00d21856bd266472
SHA1 3104f0b9786cd56a4b08719007a1bf558490fa66
SHA512 2ccf9e4a15fadaa458f9c9c216ff215725ce22d162300ee4d9e0232164e60fa9d75bb3453e4766b2aa048fdc4019284de9c89162da508a38cac8aebbe6eb383d
SSDEEP 3072:Sry1Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiQH:SrcY2WL7LAd0ZqyPvQH
TLSH
T148C30222A599246D0037CE29354539864DF58662CE9DDFEDFAD03FCAB0DF4483E8A127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 124KB
SHA256 01c2975394806d4be4072062bd211d838babc73dec55d23074345c4c783f3b84
MD5 7a2507f110c1b8e9fc6c8dee32485540
SHA1 b3c4bb15c0afe11157109f6e5dde2bdc2d85d1c5
SHA512 2ce416bf163268361e969888e0efa2dbe496f4c8ac4017035094a33f98c7a4f7453452fa7c5f3142aeefc3e72895de40fc4debdcdbbf3535d60295382cb59069
SSDEEP 3072:StW1Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiQH:S+Y2WL7LAd0ZqyPvQH
TLSH
T17FC31212A5A9242D003BCE2579466A8A8EF144518EDDDFEDFFD02FCAB0DB4443B85237
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 125KB
SHA256 23f44523037b7cb91537ada2df376b2d2eb9079e54d613d7bed20f0e98628ce7
MD5 69adb1d6edfe98063ec279fdbcd3b35d
SHA1 043b033551a5c7c792ed8ce8b99eb3efa2e5992b
SHA512 e3542fa891b987cb120e04ce48c6e52de865bbd0e12e53508c0b545193e5cc79c0032a3f1a4f7cc6abe02f1b1d011af493ab4ed253fc9b95bf193ba0e45f4ddc
SSDEEP 3072:qry1Y9+3TL3EykL7LLsOEupeJj0ZUly+ZaHCiQH:qrcY2WL7LAd0ZqyPvQH
TLSH
T110C30222A599246D0037CE29354539864DF58662CE9DDFEDFAD03FCAB0DF4483E8A127
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 11403bfba8ea475cd2161ced465599ec6b28b05099e50eafc98d1047703000bd
MD5 372c9a3e1a6dca302bf128362c51b508
SHA1 0f94f68ec4f042d3e80ccf786b00492ae562f136
SHA512 9eb51b68070c7680c9eca1ac76570d0de52f7975e53752a7d359d42655374843dd309976266c1c46c7d65b7995b6a4aadb493ce8083b59f6a447014e595aeb3a
SSDEEP 96:7C0d+uxNdc8TX+fqHyR39jaRDotok5QDDPB6OGyvXnQgERB2Fnb3nJv4a:7C0BxNdc8b9oaDUD45SiQ9R05b3nl
TLSH
T1E1A1F972696D89779476D989B5427B43CEB8A06BE610BF98E8DC1F0C11BB4DC1382227
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e4519ee111087f538c263265602f50ded4fd0a8d30a1eb29782923b7ecf6f706
MD5 d977ed51ddea169ff3aaacb58cc9fc88
SHA1 1161e22350839b669f3e2b6cb5cee6ee9c25e467
SHA512 3be5b17585bc96cf349403e8b57f50691da3e8f841f657a12d21c7bac323eb584bb56037d190cf5f25e30923fa75219cfff261e56df71e06f9d9981a3fd990d4
TLSH
T187D022213628F001E62A10B34D30832012198A4A29A39A0A3C90804AE8A6080A2D244B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 01fc33638563dc8ab1a7b28573704bed2449b99eedc9bd38a25b21316506e8a0
MD5 11027c4e8a2219c9ce2e898ab0ee23b7
SHA1 035426b9d83735103c3507c9017885546a4bc3f1
SHA512 a538fa52093c0e8ae9c8760749e2905603b5390edd667d6d7eed03fc52795e15b07573b9fb01fe984851203afcec62a80bbc50d6e99f5fbb2fc0771ec7bb014b
TLSH
T1B2D022213628F001E22A10B34D20831012198A0629A39A0A3C90D04AE8A6080B2D2447
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 679d5e74363ab76dc16d4d61ffd48546af1dba47cc4e3f422469257fbb3fe72e
MD5 ecf4bffd8fa6645f7ef985abdfc1db09
SHA1 7573a5168d16d0707a8728e66eed6d37648c9c64
SHA512 a9547c46f7fa3cf9382c01524815566c216067bba49d0e2ad320c35797891d891b8ff613db0ac608ee00932e3b4c090602db2b817d4cf1644530daee02d9988b
TLSH
T1CDF0F4AAC820AC7718FC5B2960A55B87EB60135B2B80895B3A3D960D8FB467F468581C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 15638b10a5008973121be13430a0052f6018ab30d879464f7df8da437d21458c
MD5 c60ef91fe5f50f15d98b084a631df85f
SHA1 c41e718d9f0e2fb27f478c9ec7ee687fc9406f18
SHA512 04b427eccd6aa21fb9687d3d70da6d532f85e7babc2b19a563f36cd4f2aa78faac52e96ef067a93eef681e5fe20ff8e9e1e9c4266d0f2f2366500ca5713ce16f
TLSH
T122614099542229E3DF737638DDD220FE37B094B8920B2D141C94A038BE7AF1E54727E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c71ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5c71ec.TMP
Size 3KB
SHA256 a79bf61c72df7aff74c8324ffd701e4b46b87d27cee83c9c7c061ebbd85a9635
MD5 f52dfbc1e534c3c87aa1214468150997
SHA1 b8bdef14f19aec0a3341a9515e1352133fb0679e
SHA512 6412f2369bcdc09a8b37e062302d3226bcd71aa668f9dfe80720641fe4104664004f5f6c22a2fbed039c8c981e2bde32d54d9b7bfefd688326e7ef435419457c
TLSH
T15F613199556228E3DF737638DDE220FE33B094B8920B2D141CA46078BE79F1E54727E8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f290e2bf-7818-4ee8-9043-bd5ee1b1dee8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f290e2bf-7818-4ee8-9043-bd5ee1b1dee8.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a99cfb694c421ef45b65e9f28d1a30c8a9f34f81f7f5260f12e6cc6030081540
MD5 3e3b60633ea8f86f0e41398befc3102a
SHA1 c4da41a1b5badde37e428eab484f4aa4e7f2e2a3
SHA512 acfb9f7be8f11192d366aae3e22da8b59df2c3229e0f744fed6de819dcb6b0912fa799ae66946cc48b76130a1b197169ed302bb6e596639ca9e72db01e3fe719
SSDEEP 192:sxRpRzyMqZjK1Ml8wcV/fPsbNB1ZuEsZdzoA8pSB8/g6+WNqr3/Y1CZD+GeIgjjJ:sxRpICV/fPsbNB7QZQ3/5S/XDcjV
TLSH
T13F72C816A9389977CCDBD219FA55BB53D2F81563A2905E44AAFC8B0C00E7ADD211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 ddafcf1b872acfb84d5595be4795950ca1b25d7ba2b060f7271de7ea93f61809
MD5 c8613a809b9ea8d1cc04ce8d65a1147f
SHA1 526112b302c59ce2e17fe87ca18ff075fda5a125
SHA512 28377b90e631254775708bb23b36de0aba10149f970917fc5b0e3c6ad8936e606bab34d5be609dbee2205c5dce4653e180f2482d0d8c578cc692b69d3a154222
SSDEEP 768:z2SIZz7pLuL7uTWgBdfLk8F1+UoAYDCx9Tuqh0VfUC9xbog/OVLtbIvbgZvro1l7:z2SIZlE7uTWgBdfLku1jaKcvkZ8r7
TLSH
T151E2ED3B680CCB7E4F40499CEC29BE9A6DE801CF96D8C99447FA444C03C6AEB52175D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 5c7da07f168af8566b6a91988a9114a446c69b2afdef2b907db7da56a9f67a3f
MD5 88f6aa5259a7beaac3fd6f9ad99bd3f8
SHA1 bbf342cc6c09ba383c3a6f7f6753466e5deb022d
SHA512 0659e2e0f54b9b30813b8fffb940a7dc6e4381834f1132f3eb0ff121ce944a074e04f8a8eacb80784a4a17c9d5940dd6841854b7f7c2e8a9c7fa950bac36c967
TLSH
T18AA002A00AD00891CD11037622B111D227654C200746CBA3C1ED0494CAA25574286698
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 7c53308de2983a65ca7e9f16c055995c5b48d35b29a8b56e4457828e92a6ca3f
MD5 ac17a6fe3b2e94778d5c0ad064fa6317
SHA1 ad434197799ac8575dd664522a53dbe611c1b612
SHA512 29071b046b42eeeb3d530dabec94f82853e82db84982e24c2d6656609dead89b7df4593a9df257ec50f4d67d29a8cbd24e2f59433681cc98ca9b5f0d12d1d59b
SSDEEP 192:ijdt9ZpfpRBNwVnqxpJFBTPLIB/w7lBsjXJ77ov+7fVcQpWRpGPh:iJtPphRvwFqzJ/TzIpwD+
TLSH
T1B1C23C117A7E220138BE2508E195966F674230B3705AB63B3B7D20F64EABE005FFD5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8b1bf1ecf220fc191f8f230e9e297bfa2a59d876fef23ef01d8e6c641b6077ed
MD5 8670688036ed49bef335cc224ec2d4a8
SHA1 f5adca91fbebf1b19522357aa951cc9a90fb771d
SHA512 1a8573c136f5431974c252e11b9ba5cbcb39178d085e9176df420873e545d3442b33c8a71feca55878fcc15504ec880d4dd8d6d255b9a13c782d8e9feebc759e
SSDEEP 384:n1iF1tNn/s3n9S18NR8TUNTUlIRzLqYB7uxjcCfLjG5zK3fSc2XIWJrvsvdO8Lkc:8F1j+9cAwglgxXGAKtYWhkvd2vg
TLSH
T1C1B21832D860CE77ECEA9F88B74A7686EEE011A384C95ED8D9D85D4D00C76ED170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 57f3fae4f5b68a1dbd3ea5a901293b79f71c256ddc31f8896e8f166ff4e71eb7
MD5 72a489fb4da773b713c02f199a5d11e4
SHA1 c06d8c181cde3d06748d22626f50850d801241c6
SHA512 485296f0797b1444990ac5017529ac5e696723d3d9eeb17df5dc61cd4a94a03bbde94751e4a79b4e8f92a36a25559e8469764ed0162ce7f4d74d8a90e09806eb
SSDEEP 384:nTiF1tNn/s3n9S58Nf8TUNTUlIRDLqYBaNemcCfLjG5zK3fSc2XIeFjITGT0I5XX:+F1j+9s2wgFqeOGAKtYeFji+0mXahvM
TLSH
T16FC24A36D854CABBEDFA8F89B7097646AEE002A3D0D859D8D9DC1D4D00C76ED170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5a679b00e38870923e97c1fc52085adddc22e44eef2d59f59b369d234393889e
MD5 447c9eed743369d959ddd5eb682056bc
SHA1 4458176dd80a61517f553b498e6cbf623aed9c9e
SHA512 d22bc684e88b3a4e76093aaa39fbdc9367c55e436d3ec6ba6e05c1a8dc4fe76f30aba617c573d77d35496100a7789c0ccd3afde4ee7850d85a99a2920282de53
SSDEEP 384:nliF1tNn/s3n9S18NR8TUNTUlIRzLqYB7uxjcCfLjG5zK3fSc2XIWJrvsvdO8Lkc:sF1j+9cAwglgxXGAKtYWhkvd2vg
TLSH
T17CB22932D860CE77ECEA9FC8B74A7686EEE011A384C95ED8D9D85D4D00C76AD170BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 08be2a9399772c9ea7f21e7ea882d50d30014aec7c0c8fcd17fe0669db34c4fa
MD5 f34395b5b81fdbc3765bd2c0f9eb7171
SHA1 650a4912683b9d25b870de61d073beab3de943c4
SHA512 1ec10557e6c86acb47e5437ad55005302a3afdbc5e5a5eb6c942b8fa745f64e4078acabce3c9511a96ff159bebc1f636d17f9aa77db6aeec7f46441a0535c040
SSDEEP 384:nTiF1tNn/s3n9SY8NR8TUNTUlIRKLqYB7uxjcCfLjG5zK3fSc2XIWJrvsvmn15wt:+F1j+9dAwgIgxXGAKtYWhkvmn12bfZCi
TLSH
T142D25A36D864CE77ECEA8B88B7497686EEE441A385C859D8D9D84E4D00D33DD170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2.tmp

Path C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp
Size 36B
SHA256 a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f
MD5 8708699d2c73bed30a0a08d80f96d6d7
SHA1 684cb9d317146553e8c5269c8afb1539565f4f78
SHA512 38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264
MD5 SHA1 SHA512

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5972_637131411\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

FreeYoutubeDownloader.exe

Path C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
Size 396KB
SHA256 cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7
MD5 13f4b868603cf0dd6c32702d1bd858c9
SHA1 a595ab75e134f5616679be5f11deefdfaae1de15
SHA512 e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24
SSDEEP 12288:jANwRo+mv8QD4+0V16nkFkkk2kyW9EArjaccoH0qzh4:jAT8QE+kHW9EAr+fr4i
TLSH
T1B884CF39E2A1C17AC02109B5D84BC1F6B17AAF00DB7804CF77E97E5D783326D1BA5296
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LoveYou.exe

Path C:\Users\Admin\Downloads\LoveYou.exe
Size 22KB
SHA256 1edc8771e2a1a70023fc9ddeb5a6bc950380224b75e8306eb70da8eb80cb5b71
MD5 31420227141ade98a5a5228bf8e6a97d
SHA1 19329845635ebbc5c4026e111650d3ef42ab05ac
SHA512 cbb18a6667b377eb68395cfd8df52b7d93c4554c3b5ab32c70e73b86e3dedb7949122fe8eea9530cd53944b45a1b699380bf1e9e5254af04d8409c594a52c0e7
SSDEEP 384:o4LBivz/4RHCxN3IBUDzfGWCw2cKgDwg7dEsL9s+cLUoHl:o4LBu74Ro9ImnfGWJ2cKgsgZDW+cLUe
TLSH
T124A2C81BD6DDB012F529A2B61E2A33B69D2AFCF01D9162C7BE645E4D2D361F1981030F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\Downloads\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MadMan.exe

Path C:\Users\Admin\Downloads\MadMan.exe
Size 2KB
SHA256 17d81134a5957fb758b9d69a90b033477a991c8b0f107d9864dc790ca37e6a23
MD5 a56d479405b23976f162f3a4a74e48aa
SHA1 f4f433b3f56315e1d469148bdfd835469526262f
SHA512 f5594cde50ca5235f7759c9350d4054d7a61b5e61a197dffc04eb8cdef368572e99d212dd406ad296484b5f0f880bdc5ec9e155781101d15083c1564738a900a
TLSH
T1A051A5075EEDBC13E369CEF51532A13929B6303A229B26C8CB8BE33574486217C54AD7
MD5 SHA1 SHA512 TLSH

Submit Download

PCToaster.exe

Path C:\Users\Admin\Downloads\PCToaster.exe
Size 411KB
SHA256 85a58aa96dccd94316a34608ba996656a22c8158d5156b6e454d9d69e6ff38c3
MD5 04251a49a240dbf60975ac262fc6aeb7
SHA1 e211ca63af2ab85ffab1e5fbbdf28a4ef8f77de0
SHA512 3422a231e1dadb68d3567a99d46791392ecf5883fd3bbc2cae19a595364dac46e4b2712db70b61b488937d906413d39411554034ffd3058389700a93c17568d2
SSDEEP 3072:quJFS5Aqu+WwjxeI/0gVnfKl0FA+aPobO24yNz88iu8vDYHTlI5EJD5Hbibfd6PK:/JM0mCsWq1/qpz+nF5c
TLSH
T14A946082EA1681E8F82B72F1669D3CC418A25C9D94C6D61FB1B735109933783DD7BA0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scr.txt

Path C:\Users\Admin\Downloads\scr.txt
Size 45B
SHA256 7e9cde40095f2a877375cb30fecd4f64cf328e3ab11baed5242f73cbb94bd394
MD5 ad1869d6f0b2b809394605d3e73eeb74
SHA1 4bdedd14bfea9f891b98c4cc82c5f82a58df67f6
SHA512 8fe0f269daf94feaa246a644dbeeda52916855f1d2bfd2c6c876c7c9c80b0ceb7e42caf0b64a70bda9a64d4529b885aaa38998a515d6abbe88ad367e72324136
MD5 SHA1 SHA512

Submit Download

Free YouTube Downloader.exe

Path C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
Size 153KB
SHA256 a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7
MD5 f33a4e991a11baf336a2324f700d874d
SHA1 9da1891a164f2fc0a88d0de1ba397585b455b0f4
SHA512 edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20
SSDEEP 3072:PkFkkk2kyWxkFkkk2kyWD4zC270lkFkkk2kyW:PkFkkk2kyWxkFkkk2kyWDwOkFkkk2kyW
TLSH
T1C9E37239E779D159C85852F2F914C0F202F4AF11D6B686576FA0BF6B34F223D0BA1A12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/240-1622-0x0000024D0F570000-0x0000024D0F59E000-memory.dmp

Download

memory/628-2074-0x000001CFB4980000-0x000001CFB49B6000-memory.dmp

Download

memory/2340-1638-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/2820-2125-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2176-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2672-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2647-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-1887-0x000001A215FE0000-0x000001A216016000-memory.dmp

Download

memory/2820-1806-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2635-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-1878-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-1821-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2089-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2097-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2096-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-1813-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2093-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2137-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2610-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2292-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2305-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2342-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2367-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2405-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2431-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2448-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2461-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2486-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2498-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2524-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/2820-2534-0x000001A216030000-0x000001A216031000-memory.dmp

Download

memory/3764-197-0x000001D8502A0000-0x000001D8502D6000-memory.dmp

Download

memory/4108-1784-0x0000000000400000-0x000000000046E000-memory.dmp

Download

memory/5300-11-0x0000019A80310000-0x0000019A80346000-memory.dmp

Download

memory/6916-1620-0x0000000000400000-0x000000000043C000-memory.dmp

Download