killmbr | b838a79a65c6d1e12f46deaba3584e4c88ebccdfdc4214b4535ece4ba3c0abbe

Resubmissions

01/07/2026, 19:59

260701-yqpxnsdy8m10

01/07/2026, 19:55

260701-ym4awsfx7110

Analysis

user interaction
yes
max time kernel
136s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ForzaHorizon4.exe
Size 152.1MB
Sample260701-ym4awsfx71
SHA256 b838a79a65c6d1e12f46deaba3584e4c88ebccdfdc4214b4535ece4ba3c0abbe
MD5 9cd142955c5c7e4c5bac486709c66891
SHA1 b854427abf85715a052425262a4ecdf971167d2e
SHA512 60566016ba31218a80009a1b363ed973c356a144f661f522f3ac465fd02e1ff191f783fb5b496941a519a78beb0133adc5c2cef5b0d2b39eda561b81a20e6293
SSDEEP 1572864:CYyaVl+Bsr6asnmteN/erC4dnrGY+IBAvbV+rZWo4qjrImF:CYzlr6asnmYxerrGPIBAvJ+rZWSpF
TLSH
T16E78BE05BB81CDE1E41AD2759D6F82487662FC749F8187CB34EAB30D6E7E2C50E72825
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence ransomware trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c6e0-941.dat	family_killmbr

Executes dropped EXE 7 IoCs

pid	Process
852	MEMZ.exe
6040	MEMZ.exe
1268	MEMZ.exe
5044	MEMZ.exe
5136	MEMZ.exe
2356	MEMZ.exe
2012	MEMZ.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
2	raw.githubusercontent.com
77	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4500	chrome.exe
5492	msedge.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274093941097989"	chrome.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	cscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	chrome.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6040	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
1268	MEMZ.exe
1268	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
1268	MEMZ.exe
1268	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
5136	MEMZ.exe
5136	MEMZ.exe
1268	MEMZ.exe
1268	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
5136	MEMZ.exe
5136	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
2356	MEMZ.exe
1268	MEMZ.exe
2356	MEMZ.exe
1268	MEMZ.exe
5136	MEMZ.exe
5136	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
2356	MEMZ.exe
2356	MEMZ.exe
1268	MEMZ.exe
1268	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
5044	MEMZ.exe
5044	MEMZ.exe
5136	MEMZ.exe
5136	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
1268	MEMZ.exe
1268	MEMZ.exe
2356	MEMZ.exe
2356	MEMZ.exe
6040	MEMZ.exe
6040	MEMZ.exe
2356	MEMZ.exe
1268	MEMZ.exe
2356	MEMZ.exe
1268	MEMZ.exe
5136	MEMZ.exe
5044	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 20 IoCs

pid	Process
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe
Token: SeShutdownPrivilege	6076	chrome.exe
Token: SeCreatePagefilePrivilege	6076	chrome.exe

Suspicious use of FindShellTrayWindow 43 IoCs

pid	Process
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe
6076	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 2256	6076	chrome.exe	88
PID 6076 wrote to memory of 4848	6076	chrome.exe	89
PID 6076 wrote to memory of 4848	6076	chrome.exe	89
PID 6076 wrote to memory of 4500	6076	chrome.exe	90
PID 6076 wrote to memory of 4760	6076	chrome.exe	92
PID 6076 wrote to memory of 4760	6076	chrome.exe	92
PID 6076 wrote to memory of 1576	6076	chrome.exe	93
PID 6076 wrote to memory of 904	6076	chrome.exe	94
PID 6076 wrote to memory of 1576	6076	chrome.exe	93
PID 6076 wrote to memory of 904	6076	chrome.exe	94
PID 6076 wrote to memory of 1664	6076	chrome.exe	95
PID 6076 wrote to memory of 1664	6076	chrome.exe	95
PID 6076 wrote to memory of 3132	6076	chrome.exe	96
PID 6076 wrote to memory of 3132	6076	chrome.exe	96
PID 6076 wrote to memory of 4712	6076	chrome.exe	97
PID 6076 wrote to memory of 4712	6076	chrome.exe	97
PID 6076 wrote to memory of 4952	6076	chrome.exe	98
PID 6076 wrote to memory of 4952	6076	chrome.exe	98
PID 6076 wrote to memory of 1860	6076	chrome.exe	99
PID 6076 wrote to memory of 1252	6076	chrome.exe	100
PID 6076 wrote to memory of 2532	6076	chrome.exe	101
PID 6076 wrote to memory of 1252	6076	chrome.exe	100
PID 6076 wrote to memory of 2532	6076	chrome.exe	101
PID 6076 wrote to memory of 852	6076	chrome.exe	105
PID 6076 wrote to memory of 852	6076	chrome.exe	105
PID 6076 wrote to memory of 2952	6076	chrome.exe	106
PID 6076 wrote to memory of 2952	6076	chrome.exe	106
PID 6076 wrote to memory of 2344	6076	chrome.exe	107
PID 6076 wrote to memory of 2344	6076	chrome.exe	107
PID 6076 wrote to memory of 2696	6076	chrome.exe	108
PID 6076 wrote to memory of 2696	6076	chrome.exe	108
PID 6076 wrote to memory of 3120	6076	chrome.exe	109
PID 6076 wrote to memory of 3120	6076	chrome.exe	109
PID 6076 wrote to memory of 4780	6076	chrome.exe	110
PID 6076 wrote to memory of 2780	6076	chrome.exe	111
PID 6076 wrote to memory of 4780	6076	chrome.exe	110
PID 6076 wrote to memory of 2780	6076	chrome.exe	111
PID 6076 wrote to memory of 1780	6076	chrome.exe	112
PID 6076 wrote to memory of 1780	6076	chrome.exe	112
PID 6076 wrote to memory of 4768	6076	chrome.exe	113
PID 6076 wrote to memory of 4768	6076	chrome.exe	113
PID 6076 wrote to memory of 5020	6076	chrome.exe	114
PID 6076 wrote to memory of 2836	6076	chrome.exe	115
PID 6076 wrote to memory of 5020	6076	chrome.exe	114
PID 6076 wrote to memory of 2836	6076	chrome.exe	115
PID 6076 wrote to memory of 712	6076	chrome.exe	117
PID 6076 wrote to memory of 712	6076	chrome.exe	117
PID 6076 wrote to memory of 3068	6076	chrome.exe	118
PID 6076 wrote to memory of 3068	6076	chrome.exe	118
PID 6076 wrote to memory of 824	6076	chrome.exe	119
PID 6076 wrote to memory of 824	6076	chrome.exe	119
PID 6076 wrote to memory of 692	6076	chrome.exe	121
PID 6076 wrote to memory of 1228	6076	chrome.exe	122
PID 6076 wrote to memory of 5948	6076	chrome.exe	123
PID 6076 wrote to memory of 1376	6076	chrome.exe	124
PID 6076 wrote to memory of 2532	6076	chrome.exe	125
PID 2532 wrote to memory of 4436	2532	cmd.exe	127
PID 2532 wrote to memory of 852	2532	cmd.exe	128
PID 852 wrote to memory of 6040	852	MEMZ.exe	130
PID 852 wrote to memory of 1268	852	MEMZ.exe	131
PID 852 wrote to memory of 5044	852	MEMZ.exe	132
PID 852 wrote to memory of 5136	852	MEMZ.exe	133
PID 852 wrote to memory of 2356	852	MEMZ.exe	134
PID 852 wrote to memory of 2012	852	MEMZ.exe	135

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\ForzaHorizon4.exe
"C:\Users\Admin\AppData\Local\Temp\ForzaHorizon4.exe"
1⤵
PID:5160

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffa8940c728,0x7ffa8940c734,0x7ffa8940c740
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,5826605601749948534,4343789523944067437,262144 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=1820 /prefetch:2
  2⤵
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1500,i,18065820639856712973,14938612241487375794,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,11984920218851978977,15297314524809546481,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:13
  2⤵
  PID:4760
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3068,i,2012580910746867582,4832907421225778233,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3076,i,10869872019545973104,4753733476753059844,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4672,i,5560684453487394710,16220218744588911479,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,13606087291569941964,9468761730024343729,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:3132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5056,i,15960121894102624557,17528073002746241540,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5092,i,3362367917301917638,17909623878323733699,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,5742212281872003180,3459076292703431328,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:14
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5460,i,4587872385542390067,9509954964346874204,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5448,i,12117977991241719441,8286561060957880553,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:2532
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5756,i,3528604366704693779,5944252221459037485,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,8601122385380376728,10626063437262050020,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5944,i,12083840298112970674,14697128462446850913,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6276,i,603617857742454311,16399211894572900430,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6232,i,17978493390763998351,7188079405114731769,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6176,i,14758585842219917958,1997008790817397938,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=6156,i,14519349226471820375,12266667545904644129,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:2780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5548,i,14042630356502410280,9339932004033901215,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5500,i,17058086724471146276,15645358477171490406,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
  2⤵
  PID:4768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=4752,i,10991087251209999539,4477135745391841371,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=5764,i,11204653575050182031,1900139496126185686,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:9
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6064,i,16777309651444441744,8407624466832412964,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=3564,i,4744025441016567631,12553999299259019596,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6000,i,4034842539983573136,5834259928732310780,2097152 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6680,i,7749347633206104174,12255853422438194615,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:692
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6360,i,1707768069887728275,14594009375411336034,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,6202372736424454632,14037666290029792225,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,4460394267851652865,5494517148602297357,524288 --field-trial-handle=1832,i,1652969187419682600,11827595916776567715,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:14
  2⤵
  PID:1376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\MEMZ-Destructive.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2532
- - C:\Windows\system32\cscript.exe
    cscript x.js
    3⤵
    - Modifies registry class
    PID:4436
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:6040
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:1268
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5044
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:5136
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      PID:2356
  - - C:\Users\Admin\AppData\Roaming\MEMZ.exe
      "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      System Location Discovery: System Language Discovery
      PID:2012
    - - C:\Windows\SysWOW64\notepad.exe
        
        "C:\Windows\System32\notepad.exe" \note.txt
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=g3t+r3kt
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        
        PID:4440
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x318,0x7ffa6960c188,0x7ffa6960c194,0x7ffa6960c1a0
        6⤵
        
        PID:2832
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,11418151113809262727,7461270442008646385,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:11
        6⤵
        System Time Discovery
        
        PID:5492
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,3382693438393393416,15391701917549388934,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=3260 /prefetch:13
        6⤵
        
        PID:4332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3512,i,12850436977019989359,8908056934023642037,2097152 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
        6⤵
        
        PID:2252
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3516,i,10118976287960114739,15789344724396642446,2097152 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
        6⤵
        
        PID:4648
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1992,i,11573209741259000780,14581888221993097924,262144 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:2
        6⤵
        
        PID:1872
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,12575962036152969846,5615068417233761988,2097152 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:9
        6⤵
        
        PID:2344
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,3627776953727653871,4650713565388584123,2097152 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
        6⤵
        
        PID:1368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,3267379569159510534,9292694208858737344,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
        6⤵
        
        PID:2084
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5336,i,3463113886108847305,7271434949086204081,2097152 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
        6⤵
        
        PID:2548
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,12416285613790028577,7437474267936691167,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
        6⤵
        
        PID:3944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3988,i,8245277879653265240,4058940005706654217,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
        6⤵
        
        PID:4992
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3000318078013537366,3431368203877763483,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
        6⤵
        
        PID:1764
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3000318078013537366,3431368203877763483,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:14
        6⤵
        
        PID:1992
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,15554825163442722323,10903600503591818675,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
        6⤵
        
        PID:1892
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,2223982994408166904,1888956594188817701,524288 --field-trial-handle=2796,i,14083521389881046724,473226108684540653,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
        6⤵
        
        PID:2444

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1008

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a04a31a9d5118e54a290cf5f87e4de87087ba24884a786012de69e950eddd1e4
MD5 5b78f4f82468bd1e6617e7013fa86475
SHA1 947aa1f02f3ec3161cb91c96b26c07b640a0c936
SHA512 f2ebbafbfde6fb421cb6a1fc51afbf5c0cdbc4b827d1329601da243251da6da2bce8c62466a89b5a680e790f7e2e4bf0f4434cb4404cb8e86e3c248812f40a42
TLSH
T10C611C7793C285F5CF703279ADF74F21B4B0AC85224B7E2A4587B8B8350379688700D1
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7d4bba137287564b87135953b97ffbf8d733a1a9059ad7814610fb9d7bd95777
MD5 592032ff10ea4b46b94a13da8553d279
SHA1 013e1c5a641a6398ddcd1580024c559fd1c60c65
SHA512 ac92f5306328c023ae0dae7c173e2dbb6c73b1f883c8de1b4c0ec547740eb6a3e0a76db1135d8d8174796b87178661e99d13b5be23538a680116478cccee4351
SSDEEP 192:D0DGx0t2emumoYBJqhO9V9w3/NPJaP9fPv2I8I7IpeI2v8VmmmEmDmrmtmgm7K:D0DGx0t2emumoYBJqhO9V9w3/Nha1fXf
TLSH
T16602ADF7C3D8862DC91156F9EB15AF2ECE290A14432C3C26C8E4BF4B93E2871D21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 393db2945d8beac4251ac7eac66dba049c65cadb437e72dde1c87bf694dc49b9
MD5 4466e6bd63b908ec18c431d7d46b12f6
SHA1 609eb4a6f7468644c67beaaf5349aefeba7a31cf
SHA512 42f17085c53c0e25e7eefd4691c2cabc55d98cef1f42bdccd02304c532a6b879b159b0c7fac8d6c19f2f012159f3240d6495dcd60eb919eb64eaf236b6af270b
SSDEEP 192:ORFcBz9lPbv722uIAPRp2559Nd1E9gHsb+WNiw6nz4V22BeGNvVyIsnAUgE:ORFmz9xja9XQIywc82SNJE
TLSH
T14F42966FA950657B9CCBC22DF9257756E2F1102161D01E84EAFC8A2C17EB6CC721742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 11KB
SHA256 db06930d99f3b3221299ba33533688f66bbfab03b6ccde4b20a37abb3b0023bd
MD5 d95e6416c59c74dde3eedf0bfc820162
SHA1 4cb6ea5f027942db11f5daa0207b07b3f92ccdd7
SHA512 8cc07e32cb8c815b9addf9102f28b5d9106c49b1e686b78030a067a6f33717aef22cd3249bbaa57f71d97ece1095b9893bbd4474a1a5b48ce12eb04d2faf6dd2
SSDEEP 192:ORZJlPbv722uIAPRp25i9gHsb+WNnDcdrBeG6vVyIsnAUge:ORZJxja9XDywwdn6Je
TLSH
T17932B66EA914653B5CCBD32EFD257B53E3F5102131942E84EAFC8A2C16E76CC621742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 ba117a34b1a37e0dfe2f8ead696175c6130b347de2ea839c0bfbd8c3202b01da
MD5 df4e1fa8943c73708a37fa64b8c4bfab
SHA1 c32dba3fba2ccbf56b8b7941c67d71ca20f56f47
SHA512 2ce2cb74ea79050d72f47807b0f2bc6234d8eea2402c6b8aa268c27d58da5c88cd7d861b1467e075d1e66eb6f6ad53433151903b2362f6aaf6eea0e0ec9d185f
SSDEEP 192:ORFcBz9lPBv722uI3PRpP559Nd1E9gHsb+WNiw6nAMj+4V2oBeGzvVyIsnAUgE:ORFmz9xRakX3Iywcj/2kzJE
TLSH
T19242C86FA950257B9CCBC22DF925B756E3F1102165D01E84EAFC8A1C17EB6CC7217427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 0aea7b6a352df3835a53a3211215c44c28998aea69afb88df5812c298b07002b
MD5 dae5b40cd3c446f7dec801de9f33ce5f
SHA1 322f442a7b212be81af116c0f863565e12ae8e3e
SHA512 03f73e2ea1d997408922a836ee326c958cfb3666833ccf93bba1618447d4c42ac94ce775336a4dc8b4dd09c13a8aa407b99ec16f102dec1b239a7e59844d4c9f
SSDEEP 192:ORFcBzJlPbv722uIAPRp2559Nd1E9gHsb+WNiw6nz4V2EBeG6vVyIsnAUge:ORFmzJxja9XQIywc82Y6Je
TLSH
T16742B86FA950657B9CCBC22DF925B757E2F1102161D01E84EAFC8A2C16EB6CC721742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 8a7851c706f81c47f75ed5f735b5f9f99dde809f61cb74ce903127def2d79651
MD5 f056db27be27330fb9a2a1fe8b1942b4
SHA1 2859a2d28108f8f5eee4fae20ce429b549df7783
SHA512 e710043a6e68761f0d3ea6f9445b24919dcd2656e2ca080121d84940efdafd45f466690e9d87adc400a76cfd39e90e77c5c0506a816c7088b526d04cf1b6c09e
SSDEEP 192:ORFcBz9lPbv722uI3PRpP559Nd1E9gHsb+WNiw6nz4V20BeGzvVyIsnAUgE:ORFmz9xjakX3Iywc82IzJE
TLSH
T1CA42B85FA950257B9CCBC62DF925BB56E2F1102161D01E84EAFC8A2C17EB6CC621742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 13KB
SHA256 06c7fbb7b8b3129499d5ee9208406391ad5faf221da2e543e92ab7424ba1f85a
MD5 bef813c232ec5f54f1ff1a1b725c41d1
SHA1 316232dea41950b979b0ed07c87a45e38d6cc1ec
SHA512 b3ba749053b6f1ec638508af82b87590f542a0e415f83bf81d77fe87302aa1b6590ad161430de78be99afcf6d2dd2e74314a0f7fabb11bb3bef82d2b442e691f
SSDEEP 384:T9jYb7KxkXqKf/pUZNCgVLH2HfgslNXXODYX+ErU37mHGu11O6e+:TdYb7KxkXqKf/pUZNCgVLH2HfgsjnOMp
TLSH
T1C452FA27688D993F0FD8D64CDC166F4FADB5025766B8492493FA9C0803A57CF124A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 dc0e047e20f219080cff77755697477482d43bbf04e05469f412a81e81832b50
MD5 c0454dda7134c75a737d3c92bec17ed7
SHA1 b5b486f5f4177cbf2b70d361124394d9afa3ca59
SHA512 e45fc660cc1a5ecbd99d40e34dc8f33e467bf285b7a545c949405f2efca5e657ff4141332ede37db2363ed5fb176bb72ad69d6aaddf0bc7e2a782823f2936ed5
TLSH
T101A0021502C50901CE0902BD168335D067106CD01726C3D766E112458D96E43D506603
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 fc07581102f26e70edff6b7a48e899091e5068d113b65bb46a0c47eb61ec7060
MD5 c7774157fa7b2d873f2c017e3c3e898c
SHA1 52c53f1f9913f63974644ccf122e9298436798c4
SHA512 d4a70cbbc52443fafbc52a7599a5b9e1b9a5dcffc84d70a367e20c65a704b70c550554929992a749068e08f0fb4f78ebc5df0a10924a5b23ce4c78948f1ef22b
TLSH
T12EA0026446C44477CD4082F271734DD7626299542D91431767D20958899B9F18251210
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 57d3a5828dc04fbef0389a769a228c9b11fe21dc309f606816ba0136505b6e90
MD5 160f08038e0ae1b8b38e28f598d6559f
SHA1 09f4a1f5b23b4479490a02b61e1922893f5bf724
SHA512 de1262457580c3c100d71bd411a8e67fc94bb917e33aa3b2f907a03491a5cec26bc18897b4ddeaec133df2a63d7096aa7967d1a86d72b4e9f9b515708835d7ca
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 fa46d807361915f9e9c8b4057096a410ca746e1d3c8f13f66274f9b560053126
MD5 9cee6140ea1b1712ee8d622818723cbb
SHA1 0e9dc91a2b2d94fcec98283c845b18903375284e
SHA512 1b253bc97c6c459388becb0e37fa3d82a966535b112fad975be7c29b4a3a098e2e182a482155a1b422dca919bda527ddb4923b3782112c379a8f2cb3fccab841
SSDEEP 3072:DX1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5D:Dlmg1kQfATCFbzQACjw
TLSH
T1DAC3125A4AF409FE171608A222422EB5F3D5A73FDF522F9C936B07F656C7C8A1346412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 123KB
SHA256 ff5ba21c446e26db74ad2fe008ce8bfbae5617b27e25ee7ee3abaf8014ddbc38
MD5 7aa1acbddbbd9c602ffbb64e772e0eeb
SHA1 a95bd76516bcd6c0f307de35cf8a6abe49d0ee94
SHA512 d66b9ebb2de0393c147f1bd4d84fdf0c925e7c635374aa6eaa800f64197d6e55d43d50ad39e5e4609deca9801dc02b9fe9173fc319c1a87b7905edb98f1445a2
SSDEEP 3072:1K1mgCELZtCpXh5qTfATCuIbzQACV1cnJLL5D:1Img1kQfATCFbzQACjw
TLSH
T17AC3127E49E40DBE0B22086121023D71EAE5BB3FDF162E9CA25E1BF566CBC891747412
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 4KB
SHA256 31a90a116220ce11b6de117a6a36d2074895ac6e59face3ca411adbc1bb7801e
MD5 dd64da957f2f73d7e1cddddca1de38c3
SHA1 f1a2c3a760014ef77767517b57d49b5ab36c37c2
SHA512 cc7b3725110e00df940e4d16268888c71984e9f1ba57a98d6d4bc10236eb9cfc39e3d79be4f7ab7f636d5d2e5fc79f441b22f5d6cf531cc23293b04daa730a35
SSDEEP 96:eC6v1d+6YI1dEYQHofAK8WyoCdPRDotok5mgDmB6XGyvSO8H9PEtvZF9v4a:eCC1YIcYkVK8Wyo8DUDJ2v88H9sthFh
TLSH
T1E4A1F83169784DF358BAC58976023B43CF64B1AB6A71AF48DADD5A0C51BB0F91302623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27eeefdbc28c4562b0f7961dbf8ecc36dc6cdfdb8dba90b92fab4f8d38495733
MD5 02240668b330773d82eb39ca82064ff3
SHA1 da6a7c95e21b04cb7aa5296fa464996f592a9476
SHA512 850ad2cbde9cda49998ffee162ecf4a7e854604619f29434682d460d4b33049219c253cb3208a75d43cda1a23a05ad280b0f98228e3cc9146d1a22b246e53b30
TLSH
T1E2D08011379CFC09C945303658515751F5155861145F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bea28d9638dac59990bdc6b9fece9f477f8d28c508c1a253fd1565bbc9fc4ae3
MD5 f10d65bdc736c03466ef52fb3e973cc6
SHA1 1553d68481be544f8fcd8f4f31978854061662fb
SHA512 1789433df7c4cb6b8c6af88635e9335389bfe36da7d8457f3b16e6d774ad9e050c045de056bbf16dcb7c5f7f882bdde6345ed9e7f12c4d6295e169346b1bbbf7
TLSH
T186D08015378CFC09C945303258515751F5255861645F8F445064D41DDC755D313570DF
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eb363e72564def98c39312e25367a59595a50baa639f153e7ef4391de0a421ba
MD5 c59f8228a96c4aa25c42b67c396cba99
SHA1 7eb78a7dab570196e101c04e15eed903398c2153
SHA512 fb8b123cc68843f3d360476a4b447fac5c608c40643048e52c3be61b2ed213f9cedfc7b4aa4abc05119844e93dbbc968873d6367d4312343ed73124367a79058
SSDEEP 192:sxRTRGyM/jK1Ml8w2o/f0s0517/aZuEwzoA8pENr/g6+WNq2A/YTAVbGkIgtJ:sxRTUYo/f0s05dMuqG/5A/xv3
TLSH
T10E62E9166A249977CCCBD20DFA557F53D6F81533A2901E48AAFC8A0C05E77ED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 32KB
SHA256 99278518c76a0503962a6327fca8df0553a9b22d62f3bb662c2cb59561ea3e08
MD5 98e03fa21e1d366e8d42ccd3b24578e8
SHA1 d3bc5e52d743adf3c4df01872a842ba85e22f05e
SHA512 84bb5e47fab4b041fa1bcb27ce682fb958e0c55de70ea17b59774e0f5d46c4d8badf426fadeccc073680e7a97a5f4db8597bbfc02bd6ac8e3cab5a655b87f696
SSDEEP 768:RGqOBJ7pLuL7CrWgTvfiX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqnQzFYhroM8h:RGqOBfE7CrWgTvfiXu1jaFnQRYaM+
TLSH
T195E2EB7F680CCB7F4F80499CEC25BD8E6DE801CB56988D9447EA854C03C67EB511A5EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c1dab86278c4284310d96ecab87b3af5626b600040c0ec9761a66c7bbd64279d
MD5 8791f01c1acbb05f721cb9f736fb5282
SHA1 0eccc57c49dcdbe588cf2bcee21ee28e16fff990
SHA512 8d2216ceabd6e763c5f51bfced7cecf79af213f5ac2a264bb4cc9c0704309d3b74495ea8e9daeef30c2cdee004bbe2ad9354c0f02adbdf6320e2f7472b856f5d
SSDEEP 96:KoJCKCgSpaxe6sMs6ukLJYK6KgPYo686CDwqUXok2Cu0uyAoAZAsA4AqA2A6AgWb:Qhpaxe6sMs3kL6KSPYob6CDwqUXok2Ch
TLSH
T12B912015323E32C1387E36089176965F828278A33555B52B3FB9A1E64B2BE01CDFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 50f4b9f1013c03e205eb09256a38226dd989a6d1308504b292c68ef16d0581ee
MD5 ed259a6a93d3ef61fbc828b8c9a439ea
SHA1 ee5d06ffa9410d0e9cb31fe0bd4d0a12c41b457c
SHA512 3717b46001bdda4836a1246c1c8699f9cb74fe0aab0cce6c089e3265ade7dde27c28459d3d9e7d191f98e2fd41f2988d5e61c3e44d5c9ca0f7aae7d9c0b2ba08
SSDEEP 768:Yrv+4UNbdj3j6WKKXodOiIyN8Y1M1fmBnlVv0B:Ybsbl3jhXodI11+8
TLSH
T14003CF32E86495778CF28688F55772433FF491A38BC50B94DADC6B0E4547AFE230B856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5d43a95e2e608c840b5a0d84556f99c7422533258a5ffa7a4b514342f58de5f6
MD5 dd2c1dc46056b6b78592bdc9fd2ed714
SHA1 33775d47b557c8a37341a45587d8526a0c7214f3
SHA512 a60b4f3870ccad951c5640b4a0d49120359895a05dbf3b1cc1c05f8e4af161cafa65d960c6f57c9189915aa403a1f5850e94740505a50db185e5bcf4ca25b1bb
SSDEEP 768:9j+9n3Y061K6XodOiIyN8Y1M1fmBnZCqUkg+:49n3Y0mXodI11xBkg+
TLSH
T1AAF2B0319991DD378CE6D688F66726856EF061F79AC41E48DADCAB0E01837FE2307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 dd94b3742cfff38c04118b13adb01fd9cb364da79078ca12eb703e10fc4241a0
MD5 8d64d0ccf8aaa9eb33fc92fd0e378829
SHA1 a28673044f5d4b0e59adf38ede8432e6ee1b9bdb
SHA512 c2f5d83ede5d79371177a5392f554a2b931fcdb9330a0ba8168078d29f04727a4960d03f97af22ae309ea835b941bb4f1ca9d866ca27a171ce086126eb55111d
SSDEEP 768:srv+4UNbdi3Y06PK6XodOiIyN8Y1M1fmBnZCDY5:sbsb83Y0WXodI11xM5
TLSH
T19B03BF31AD64D9738DF69288F55736837EF421A78AC50A48DAE85B0E01477EE230FC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b892dba2-95f9-4c0c-a346-52998dce5e5a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b892dba2-95f9-4c0c-a346-52998dce5e5a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4440_1129117241\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir6076_2072854158\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ-Destructive.bat

Path C:\Users\Admin\Downloads\MEMZ-Destructive.bat
Size 13KB
SHA256 17b1f1e3f6235008152f64ba8b8b4af4abbbeb0150db3ef32eabf04ee3bdc5f4
MD5 508ccebebaefb2fb833bf8e7febfa209
SHA1 bc55c719df63e3ebaedb280f25fc1bee5fce9ce0
SHA512 8bc9bfda22a4548c8c445267af32b61f85b663db3cb6fa7cdb5a721964cf36d0b8fe6f07b51451b4bfea16da3c58abf1facf5674638ccb1794707fc10ea91f0a
SSDEEP 192:E7N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXJ:E85qwc35O1+7y/LphxxGtHAhubXJ
TLSH
T132528D3236784E132D3026C99C0AD246FCE463F7362A5E62E413C9FA50AAED3725F705
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\x
Size 2KB
SHA256 8a23d6493da413caa0f7c248c969b2c3fd2898452ef92e5fc29c660221f07209
MD5 4d1b2c9d989501762629a41645982a52
SHA1 3f53161b85a8aae3da153f3b84f2c8085dcc0c6b
SHA512 80bd57be0c79fa0d297bd80877e16efe579d1defe80e7c01c449d0f780b3bb90ace6e1d35270ec02e2f85402dae110ffe1585bdf1ab2987f4ecbac952b0e1781
TLSH
T150516D3135F8DF17B22126E28C2760CB6CA5D53F38C545850C10897608EF40B42DDF39
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\Downloads\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\Downloads\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\Downloads\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\Downloads\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download