hxxps://github[.]com/Zusyaku/Malware-Collection-Part-2/tree/main?search=1

Analysis

user interaction
yes
max time kernel
281s
max time network
282s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
https://github.com/Zusyaku/Malware-Collection-Part-2/tree/main?search=1
Sample260707-yp26lsds91

Score

8^/10

bootkit defense_evasion discovery persistence ransomware upx

Malware Config

Signatures

Disables Task Manager via registry modification
defense_evasion

Downloads MZ/PE file 5 IoCs

flow	pid	Process
71	3136	msedge.exe
103	3136	msedge.exe
103	3136	msedge.exe
103	3136	msedge.exe
103	3136	msedge.exe

Checks computer location settings 2 TTPs 6 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Hungadian.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	Hyptonize.exe
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	wscript.exe

Executes dropped EXE 24 IoCs

pid	Process
3448	Hachi.exe
5080	Hello.exe
5064	Hungadian.exe
3668	HungadianMBR.exe
2588	bytebeat1.exe
4404	PatBlt3.exe
4196	mousedraw.exe
4792	Hyptonize.exe
620	mbr.exe
4808	bytebeat.exe
2020	cubes.exe
2596	reds.exe
804	tun.exe
3716	bytebeat1.exe
1916	rgb.exe
3408	bgm.exe
1212	RandomLines.exe
1712	PatBlt3.exe
2456	sn.exe
1788	sw.exe
2348	mousedraw.exe
2756	snd1.exe
4888	ScreenGlitch.exe
4820	bsod.exe

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
69	raw.githubusercontent.com
70	raw.githubusercontent.com
71	raw.githubusercontent.com
103	raw.githubusercontent.com

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	HungadianMBR.exe
File opened for modification	\??\PhysicalDrive0	mbr.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000a000000024325-396.dat	upx
behavioral1/memory/3448-404-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/3448-440-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/3448-463-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/files/0x000f00000002432a-468.dat	upx
behavioral1/memory/5080-485-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/5080-522-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral1/memory/5080-547-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mousedraw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HungadianMBR.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hyptonize.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytebeat1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ScreenGlitch.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hachi.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PatBlt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rgb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cubes.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytebeat1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	snd1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mousedraw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bgm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RandomLines.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bsod.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hello.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tun.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Hungadian.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bytebeat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PatBlt3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sw.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2252	PING.EXE

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Delays execution with timeout.exe 11 IoCs

defense_evasion

pid	Process
1176	timeout.exe
2888	timeout.exe
1768	timeout.exe
3024	timeout.exe
4440	timeout.exe
1620	timeout.exe
3964	timeout.exe
5104	timeout.exe
4796	timeout.exe
4728	timeout.exe
3640	timeout.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Kills process with taskkill 11 IoCs

defense_evasion

pid	Process
804	taskkill.exe
4300	taskkill.exe
992	taskkill.exe
2388	taskkill.exe
728	taskkill.exe
4964	taskkill.exe
2764	taskkill.exe
4052	taskkill.exe
3184	taskkill.exe
5060	taskkill.exe
4000	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279279256894726"	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{D54810F8-5898-4C07-BC59-64116D8B6816}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2820	reg.exe
2736	reg.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4352	NOTEPAD.EXE
1236	NOTEPAD.EXE

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2252	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3784	msedge.exe
3784	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
5032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	804	taskkill.exe
Token: SeDebugPrivilege	4300	taskkill.exe
Token: SeDebugPrivilege	992	taskkill.exe
Token: SeDebugPrivilege	2388	taskkill.exe
Token: SeDebugPrivilege	728	taskkill.exe
Token: SeDebugPrivilege	3184	taskkill.exe
Token: SeDebugPrivilege	5060	taskkill.exe
Token: SeDebugPrivilege	4964	taskkill.exe
Token: SeDebugPrivilege	2764	taskkill.exe
Token: SeDebugPrivilege	4052	taskkill.exe
Token: SeDebugPrivilege	4000	taskkill.exe
Token: SeShutdownPrivilege	4820	bsod.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 3644	5032	msedge.exe	85
PID 5032 wrote to memory of 3136	5032	msedge.exe	86
PID 5032 wrote to memory of 1604	5032	msedge.exe	87
PID 5032 wrote to memory of 1604	5032	msedge.exe	87
PID 5032 wrote to memory of 1604	5032	msedge.exe	87
PID 5032 wrote to memory of 1100	5032	msedge.exe	88
PID 5032 wrote to memory of 1100	5032	msedge.exe	88
PID 5032 wrote to memory of 4776	5032	msedge.exe	90
PID 5032 wrote to memory of 4776	5032	msedge.exe	90
PID 5032 wrote to memory of 4776	5032	msedge.exe	90
PID 5032 wrote to memory of 1700	5032	msedge.exe	91
PID 5032 wrote to memory of 1700	5032	msedge.exe	91
PID 5032 wrote to memory of 1700	5032	msedge.exe	91
PID 5032 wrote to memory of 2592	5032	msedge.exe	92
PID 5032 wrote to memory of 2592	5032	msedge.exe	92
PID 5032 wrote to memory of 2592	5032	msedge.exe	92
PID 5032 wrote to memory of 3440	5032	msedge.exe	93
PID 5032 wrote to memory of 3440	5032	msedge.exe	93
PID 5032 wrote to memory of 3440	5032	msedge.exe	93
PID 5032 wrote to memory of 1468	5032	msedge.exe	98
PID 5032 wrote to memory of 4812	5032	msedge.exe	99
PID 5032 wrote to memory of 1468	5032	msedge.exe	98
PID 5032 wrote to memory of 4812	5032	msedge.exe	99
PID 5032 wrote to memory of 3140	5032	msedge.exe	101
PID 5032 wrote to memory of 2332	5032	msedge.exe	103
PID 5032 wrote to memory of 2332	5032	msedge.exe	103
PID 5032 wrote to memory of 4196	5032	msedge.exe	102
PID 5032 wrote to memory of 2332	5032	msedge.exe	103
PID 5032 wrote to memory of 4196	5032	msedge.exe	102
PID 5032 wrote to memory of 2176	5032	msedge.exe	104
PID 5032 wrote to memory of 3448	5032	msedge.exe	105
PID 3448 wrote to memory of 4152	3448	Hachi.exe	108
PID 5032 wrote to memory of 5116	5032	msedge.exe	115
PID 5032 wrote to memory of 2440	5032	msedge.exe	116
PID 5032 wrote to memory of 3216	5032	msedge.exe	117
PID 4152 wrote to memory of 2252	4152	cmd.exe	123
PID 5032 wrote to memory of 4488	5032	msedge.exe	125
PID 5032 wrote to memory of 4488	5032	msedge.exe	125
PID 5032 wrote to memory of 4488	5032	msedge.exe	125
PID 5032 wrote to memory of 1768	5032	msedge.exe	126
PID 5032 wrote to memory of 4208	5032	msedge.exe	127
PID 5032 wrote to memory of 4208	5032	msedge.exe	127
PID 5032 wrote to memory of 5080	5032	msedge.exe	128
PID 5080 wrote to memory of 116	5080	Hello.exe	130
PID 116 wrote to memory of 804	116	cmd.exe	131
PID 116 wrote to memory of 2820	116	cmd.exe	132
PID 5032 wrote to memory of 1412	5032	msedge.exe	133
PID 5032 wrote to memory of 1412	5032	msedge.exe	133
PID 116 wrote to memory of 4352	116	cmd.exe	135
PID 116 wrote to memory of 1620	116	cmd.exe	136
PID 116 wrote to memory of 1768	116	cmd.exe	138
PID 5032 wrote to memory of 3004	5032	msedge.exe	139
PID 5032 wrote to memory of 3004	5032	msedge.exe	139
PID 5032 wrote to memory of 3004	5032	msedge.exe	139
PID 5032 wrote to memory of 1900	5032	msedge.exe	140
PID 5032 wrote to memory of 1560	5032	msedge.exe	141
PID 5032 wrote to memory of 1560	5032	msedge.exe	141
PID 5032 wrote to memory of 2168	5032	msedge.exe	142
PID 5032 wrote to memory of 2168	5032	msedge.exe	142
PID 5032 wrote to memory of 2168	5032	msedge.exe	142
PID 5032 wrote to memory of 5020	5032	msedge.exe	143
PID 5032 wrote to memory of 4312	5032	msedge.exe	144
PID 5032 wrote to memory of 4312	5032	msedge.exe	144
PID 5032 wrote to memory of 3784	5032	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Zusyaku/Malware-Collection-Part-2/tree/main?search=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffe3a37c188,0x7ffe3a37c194,0x7ffe3a37c1a0
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1984,i,6752614346123086239,8017543448547469739,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,15069148257880112917,16670270859997703975,262144 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2516,i,16759447886777976075,11025186318074125609,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15446456928191537392,6602018455601801970,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16355263252701934755,6544856260680971162,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,16549697753596966949,12647949773938724118,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5010650927466150667,10799143495473492160,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5156,i,11909656218681454666,214677153625362312,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5160,i,3604726155471089125,15090476054698077357,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6004,i,17738691740732902709,13635385349806184476,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6004,i,17738691740732902709,13635385349806184476,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5868,i,9128651045466214153,8128792799749101493,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6076,i,3117799191040288172,257624102715599937,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6552,i,15753317287367012012,3881236265508303251,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:2176
- C:\Users\Admin\Downloads\Hachi.exe
  "C:\Users\Admin\Downloads\Hachi.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\CB0B.tmp\Hachi.cmd""
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Windows\SysWOW64\PING.EXE
      ping localhost -n 12
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5540,i,1816527505193557896,4916648459182162300,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6732,i,12977281494723535085,12090566972472953200,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6792,i,9146953537877826511,18096028048420557371,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6316,i,17683823637433739375,1963753062131349387,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2188,i,16447150076428601895,1904152058136705369,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6308,i,14418836018044805997,2801991632173166995,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:4208
- C:\Users\Admin\Downloads\Hello.exe
  "C:\Users\Admin\Downloads\Hello.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\57BB.tmp\Hello.bat""
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im taskmgr.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:804
  - - C:\Windows\SysWOW64\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry key
      PID:2820
  - - C:\Windows\SysWOW64\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\note.txt
      4⤵
      System Location Discovery: System Language Discovery
      Opens file in notepad (likely ransom note)
      PID:4352
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 5 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1620
  - - C:\Windows\SysWOW64\timeout.exe
      timeout 10 /nobreak
      4⤵
      System Location Discovery: System Language Discovery
      Delays execution with timeout.exe
      PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6068,i,10146354580622687618,6136938845070513041,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4432,i,15972301748968081849,566809946162818379,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5748,i,3295389705639680969,3814972078183570844,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6840,i,12292882618326887062,4298286447873162008,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4300,i,1143834676490206437,6399475577243785538,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6948,i,11578321281215571400,628482435721239787,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5744,i,4308385508601720060,4672925437113660135,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,503368060603045696,2676229290555505716,262144 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=760,i,2285064593670001915,8346650355692465751,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6820,i,2017563570867083203,18085796722982141112,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6956,i,745008544042028208,12191949821143784234,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:2592
- C:\Users\Admin\Downloads\Hungadian.exe
  "C:\Users\Admin\Downloads\Hungadian.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5064
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\6265.tmp\6266.tmp\6267.vbs //Nologo
    3⤵
    - Checks computer location settings
    PID:4704
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6265.tmp\ur.cmd" "
      4⤵
      Checks computer location settings
      Modifies registry class
      PID:4364
    - - C:\Windows\system32\reg.exe
        
        REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
        5⤵
        Modifies registry key
        
        PID:2736
    - - C:\Users\Admin\AppData\Local\Temp\6265.tmp\HungadianMBR.exe
        
        HungadianMBR.exe
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:3668
    - - C:\Windows\system32\NOTEPAD.EXE
        
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\6265.tmp\note.txt
        5⤵
        Opens file in notepad (likely ransom note)
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\6265.tmp\bytebeat1.exe
        
        bytebeat1.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2588
    - - C:\Windows\system32\timeout.exe
        
        timeout 10
        5⤵
        Delays execution with timeout.exe
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\6265.tmp\PatBlt3.exe
        
        PatBlt3.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\6265.tmp\mousedraw.exe
        
        mousedraw.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4196
    - - C:\Windows\system32\timeout.exe
        
        timeout 20
        5⤵
        Delays execution with timeout.exe
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\6265.tmp\tun.exe
        
        tun.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:804
    - - C:\Windows\system32\timeout.exe
        
        timeout 90
        5⤵
        Delays execution with timeout.exe
        
        PID:3024
    - - C:\Windows\system32\timeout.exe
        
        timeout 30
        5⤵
        Delays execution with timeout.exe
        
        PID:1176
    - - C:\Users\Admin\AppData\Local\Temp\6265.tmp\bsod.exe
        
        bsod.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5556,i,5573328324018221278,10386632877929534285,2097152 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1048,i,11256613919817971745,9811217048496015928,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4372,i,18245636814491269371,11963024824013519237,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:2920
- C:\Users\Admin\Downloads\Hyptonize.exe
  "C:\Users\Admin\Downloads\Hyptonize.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4792
- - C:\Windows\system32\wscript.exe
    "C:\Windows\sysnative\wscript.exe" C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\A6E1.tmp\A6E2.vbs //Nologo
    3⤵
    - Checks computer location settings
    PID:4448
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\ur.cmd" "
      4⤵
      PID:364
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im explorer.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\mbr.exe
        
        mbr.exe
        5⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        System Location Discovery: System Language Discovery
        
        PID:620
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\bytebeat.exe
        
        bytebeat.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\cubes.exe
        
        cubes.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\reds.exe
        
        reds.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2596
    - - C:\Windows\system32\timeout.exe
        
        timeout 30
        5⤵
        Delays execution with timeout.exe
        
        PID:4796
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im bytebeat.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:992
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im cubes.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2388
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im reds.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:728
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\bytebeat1.exe
        
        bytebeat1.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\rgb.exe
        
        rgb.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1916
    - - C:\Windows\system32\timeout.exe
        
        timeout 30
        5⤵
        Delays execution with timeout.exe
        
        PID:4728
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im rgb.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\bgm.exe
        
        bgm.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\RandomLines.exe
        
        RandomLines.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\PatBlt3.exe
        
        PatBlt3.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1712
    - - C:\Windows\system32\timeout.exe
        
        timeout 30
        5⤵
        Delays execution with timeout.exe
        
        PID:3640
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im bgm.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im RandomLines.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4964
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im PatBlt3.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:2764
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\sn.exe
        
        sn.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2456
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\sw.exe
        
        sw.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:1788
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\mousedraw.exe
        
        mousedraw.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2348
    - - C:\Windows\system32\timeout.exe
        
        timeout 30
        5⤵
        Delays execution with timeout.exe
        
        PID:4440
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sn.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4052
    - - C:\Windows\system32\taskkill.exe
        
        taskkill /f /im sw.exe
        5⤵
        Kills process with taskkill
        Suspicious use of AdjustPrivilegeToken
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\snd1.exe
        
        snd1.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\ScreenGlitch.exe
        
        ScreenGlitch.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4888
    - - C:\Windows\system32\timeout.exe
        
        timeout 30
        5⤵
        Delays execution with timeout.exe
        
        PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3572,i,15047900700801288947,8218361658123499643,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5448,i,13477755229780526355,16399927811792450277,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=7160,i,13731966776379634366,638706912848221456,524288 --field-trial-handle=2280,i,16014927933774379789,12896009605025410528,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3cc 0x450
1⤵
PID:5004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e984bac956f8457d89edc9e9feee7e3872ee82772575ed34c7b69ec8e27f8624
MD5 2c3244ee7ee22246ab5956750748b145
SHA1 de30fede63ea96ceb7896d1a741987dc6557e7ca
SHA512 a54f20c5a324cc5822c5b021868afbfd902bf0d161e8d90aa506492ead7492455c835798ae267138b3193f40748fffe22c59c9f2ce975df02aca19f7613f145d
TLSH
T14EE07DA506DAD36EAE00645B41A8670CC2C0375FD2C87D4A2749868C7481048FBE36F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 56acf9c31ef49cefe0cb27990b17ce1d57e8e76f8b682debeede83cda693314d
MD5 980587f9f528cd222b799cf8151097da
SHA1 e3b5aa668188ffa87e48e8bd06e4870c45617566
SHA512 1c5b3a7fb42b3b56fd8a2598311f05a50c02a8536a35f28fc635a671b74bd4ad4df6c28d7d74b66e45138fdec8cf4c87fdfa08f78822a4db0d7e302a062d34d0
SSDEEP 96:kBzWuBBV5AaigG2nte8Km/lOjzOtkG7encsigXFa:6W+BUao2nAmUUkG7hLgVa
TLSH
T185C1F739036268F9DF2C1B7070D60BCC71B99BE1FAC75FC580CA98BA1A1F759011A58C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5904a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5904a9.TMP
Size 3KB
SHA256 373eac3d3e29e2593f83c1bfba17065b93c7e7e9f4f399a427cd7a0c8c164f67
MD5 0a6951c9a624a4dfd0579fe399206197
SHA1 ddb8fa8b74cf4e540ab98425059848b2ff740672
SHA512 662aa581d6077b9294ff6439bce39519b877bf4548c85578f3454a8645aa66a588ffe5bef1c7d363bb026634a7ca29fed10b606205ec3128468618028f4982f6
TLSH
T1F161D77803B23CA0E7645C7074D60F4070BACAE6FE4B5FCAD1CA99B71A1836D052659C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 67KB
SHA256 375ed6337828309bf28a1543d33ae2b9a47274581df64dfed6793b31ff2e0c7f
MD5 d1d1c63895b54e433fecc5ee6ab682af
SHA1 83cfc2fd2637c67d6710187bce37f150ef4c301b
SHA512 69e0d31bd8824c5de6357005d01e587ecc0752d456bca78fae5bd5d2d8bf987bca79ada8dc4104983352de6098be17382004eba7e8d4f18dde72123b15d7cbcf
SSDEEP 1536:alYi9t3+ZIl1Xx4TwvJIOHezllJ6zd8Ka4zo1w6NyXkTL/:cYwt3+ZMBx4TwvJlelAzDa4zoa6NyXkP
TLSH
T16C634BDCF3F8993AFBBB0F2B54B1395C48B3391328458A9D50163B6C5433A91BD52A63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\LOG
Size 341B
SHA256 b2a8b4ed105777687341ec4e4457f98a0df495d69e4a6c9965a32a5d15422e4e
MD5 1a8c000007def6f1c499f39df1f5e5c2
SHA1 00ba322fc1191efc983de4626ee335d3d7d9eeb8
SHA512 0480d2d802b879dc5d74ab116076cbfb0e60d16fc448a9d2b1b48bf9cf1493cdf560ad92bb544e0b94bdb2c7b8a67ebd7d232350c379098a19959b724ce16f7b
TLSH
T1CCE0682884C9C66F260010924124BB09C3E3714FD7C87D890F51C824B08244896AF2B1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a1c384f6829524f6e7393837aa977035ebac75a6d59f11be43f1b1ddbb991986
MD5 4721b93aa785b929773fa32eccc442d2
SHA1 0d3d88e8cc62c5150b5719e77ba62b3a4e799215
SHA512 e9736f49f61fe603db590848899da103358184216871b82c926543ca59ebf6efff7edc55b43d241343d5509f01744e42fe9e69c759bf9bf3aada8e51472baa45
TLSH
T1BF4158F783E2856D9B1259F0AA18EE1BCE2D0511831C787985E0BE57E3E3871E00175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 187badc252800208c6334f3435da7ea958eeda1ee1d2ffc06ac616b85ec3a3f2
MD5 f342386817e0b2b8e9e3b9bffe55fa62
SHA1 fc26903c45b32b0781ad02a73a3e86dc946f2d19
SHA512 5e478f151d632c1b9f2fc237c2bb786d221770b3866b9fc8e743d81e41cea0bc0a9f55b85f6d654321592d9e305d2bea57a0d29b63ee47b73d19d6797e9a1ae5
TLSH
T1AA4158F783E1856D9B1259F0AA18EE1BCE2D0511831C787985E0BE57E3E3871E00175F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c7a860dacb4b0a65443e56f79cd5d41c1a067868d89e19d627426c7211dd1111
MD5 0170c35f5595b239875f36ab8d6428aa
SHA1 d817aed8d7a8a3c875884e149561278fb7edf612
SHA512 b294aab87ffef32d9558de542b2f766948c18b6b6de22eef4128bd8a320a484e53ae15937fa9640d0f0036817d8f52bb375e89bfa04181b7055fc24340ce954f
SSDEEP 192:sxZBcRNXyM/jK1Ml8MkV/fisYGvj+zIdpDOHW6+WNYYf/Y9IgcvoZIgrJ:sxZBcjBMV/fisYG7HSHbT/Q9
TLSH
T15442D8166A349A77CCCBD209FA45BF53D6F50572A2950E449AFCCA0C05E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0ce27ee91c8090ba41ca2fc6f869bec2766d5e738a950b2234b03c684e42d3e0
MD5 060c4b83f7c88457c2cae7053b69c31c
SHA1 b52b6e72139cfa5b3ea34afd28f0f3bbbaa4cbd9
SHA512 161cad4c9aca383c6581481010203d7d7b9776468c19395eaaa31d6aeb09b1f54450c3c1b3bdb46f18e45c09e0f7507c623d73198ddd016024ac8c0ac15f8a06
SSDEEP 192:sxZBHRNXyM/jK1Ml8M9V/fisYGvc+zIdp9IOHW6+WNYXL4XY9I/ovoZIg5hJ:sxZBHjz1V/fisYGUHlHbg4Xlh
TLSH
T17352D816A6345A7BDCCBE219FA45BF53D6F50462A2950E449AFCCB0C01E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 92c4e684f36e638b38a488b6993deb97a057a582a5529d43d29c27409e3799dc
MD5 9cdce515b0693b681532f27729ecd278
SHA1 41c036d2c9af08968aba3d8060e2b14b63fce53c
SHA512 7ff2a17af94c459bdb31ae702a4f1e75874c83ddd34500198bca4cf49accdc802da463408aa2eba4cea94d40f8e13c3f32ae57dde121b8631ac3c0ae927ce057
SSDEEP 192:sxZBHRNXyM/jK1Ml8UQv9V/fisYGvc+zIdpvIOHW6+WNYAuXY9IC9CvoZIg5QJ:sxZBHjzqlV/fisYGUHbHbqXgy
TLSH
T15062D856AA345A77DCCBE21EFA51BF53D6F5042292940E449AFC8B0C01E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 76649db79155df6bd4c126cfb64af0ea74694f7c58fe6d4b8c689f577d3a7440
MD5 a8e825c23c222a709029079cc472fe80
SHA1 f19f44cf320e6cc72afa2330e2cae7ecc34cb474
SHA512 e0ae8fb43232d34d391384bd672e023d0d7f68e1e613d12c3856660d4a274054878d2b9256fdda1c32b2f75f1075774294f5070fdf296eadd68bb46b11e0e21f
SSDEEP 768:STcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNdroqg6Zf:STcv21wWvu+Z+u1jaeFLeRNWqJf
TLSH
T148D20A2B280CCB7E4F841E9CED2A6F866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9a4848f13eb2ac62d607a97136e8a56e957b2018ffdaf0b6aafd113e8960d055
MD5 da1d63a571f2a765a23af52918157e38
SHA1 68d48ec7c512ea5c4c2cd708186b6e05e9c2f42a
SHA512 f661038a59c365653fdfded932089728c9588c10665c968f124ce95101415160d62032031bbec67d691fdf82397465693cbef036feaa55772df66959529fb98e
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD4D6HTNJ9wZx0jrbwKjlrlwnrbkFDd414xI:mT4D6HTNJ9ox0nbPlrlArbkFDd414x16
TLSH
T17A914416713B4282387E684CA36596368E8175677424E96F7BFC40A24F2BE136CFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9bcf3a5-6cd7-40f1-8533-036d34cda13f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e9bcf3a5-6cd7-40f1-8533-036d34cda13f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 607e159498eb609db05b611740a4839490b4326f94124c5a6245ad91d0b4aafb
MD5 2788b1d108cd6f98805d293b1baa073e
SHA1 1655226ae4081ce533b4f0e213a9f6ad4f62df46
SHA512 78b2aadfd1e49c350f4ea12be01fe313237d285d0c41640a95dd574cd3fb2b7505391bffe02170c45d41cf2908a33d6672632be266d7406224f11f3eebbb442a
SSDEEP 192:ueLsNn06iQyeGf8+YLea1QmiU1TZj4e+CGdOt/X3sJiCq5qdO08:jsNngXf8zioTMe+CwOt/Xx5qdf8
TLSH
T1C8423A3ABC784D766EE6A655F44732139EB48167D6892F90D4ECAF0C02CF2AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 5f2ad77fea6d32d32afdb0e35b50e7a2229f9c67b21c68c68aca3b9b63c269e3
MD5 ddd364113167bf6ffcd3b2bd07510002
SHA1 34b4c4b4a77f13741fb67fc9284c2ea95e1d76d8
SHA512 1003adf381e86b47eb3c517ee3106d84653db3e4e322e5b8ee7ba72247851f6ee16dacd620b5f1c051847e31ab9e93738961c4fdb0e66c37d232bbb11bf1afec
SSDEEP 384:2iFltNn/s3n9SnasN58TUNTUlIlsXf8ziYzMe+CwOt/XK5qdfO:dFlj+9d0wgUoZnYOVXK5AfO
TLSH
T149B207F658D78936D99D9B47B73E2E038EBCC067B5812A40B3985A0CCD8B1BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5718b5d90007265ea776ad2b74cef21b94b235e79d7fa0e01146bea139d9124d
MD5 351e777231b10713a0355506c305bd36
SHA1 9f5bddc9a1e53d1b0be0e23b3796e376ea412a09
SHA512 bf5dd2e03d737eacdf3e099d539c109cf63fe2a221207da23a0c360f87d75a91b0b748e2b5c18bc3956a544c6379c01d32ee1e1997bbfa54b84a7faf31d2df38
SSDEEP 192:JOND6v+YLNQmiUyvKZh+CGdOtPusCk+U6:JOND6vz/jZh+CwOtbkU6
TLSH
T1F402E8357D781C7B9BE2AE05F48736279FA4113BEA912F80D9E82F1C01D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 248e47cf02461cd35fe8182e20c3e41484125f7f77ec9163a99634f6e3a2c0d9
MD5 756ab3523972a976949d567c4a156caf
SHA1 6213f7662f142799ab3519787f01badc5d17ce0b
SHA512 4c6ff169bf78c49233e65630fff0816f44d43d1bea38e5975640333e8bd27b2f538071a2d50c065a184fe1ae1085db0b3c6623b4b4deeb39ffcfa2838a2c68d2
SSDEEP 384:GtNn/s3n9SssNnsXf8zi9TMe+CwOt/Xx5qdfO:Gj+9f1ocnYOVXx5AfO
TLSH
T10E727C367C794E675EE2A599F50B36179FB4816792862F80D4ECAF0D02CF3AC1306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2cf35195025164d6d57136dda3eb27d8cdd4605d1570a3010527365146002a16
MD5 952c81a3a93ca18e1d141ae0e1d6a646
SHA1 ab4ee471f874c50053fc336ad2069011428a81b2
SHA512 7250b99d3bb866e2c9b910e9acba4c5979afb04f8f4f1df9d42a0add2ada6bd97b16bf6b43a25dc8ff622545b9e2541754566af415d0ca37a52f45c97276fd15
SSDEEP 192:KONS6v+YLrQmiUyTKch+CGdOt/XoCHCq5U6:KONS6vzpRch+CwOt/XJ5U6
TLSH
T122121A367C785C6B6EE2A955F48736139EA45127EA863F80D4DC2F0C02DF6AC230A817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 19d3264f8e2cf7b5156bd11eb3d53eefea39483fb11cb49c0631bbb689c2c655
MD5 9038f21c7d8c714f8b880b46293c92f7
SHA1 62da99525f58c7db570fae9a5b5b508070f8ede7
SHA512 30fd33e2a157f8dbf09cb4f3352083658c8cc74e8797b57888bdd5dfd4a1a9b9aa82bb82ecc61f2f7bb1cdf385149be112faa04215604c6a5cba2439bc6c8108
SSDEEP 384:2iFKtNn/s3n9SnPsN58TUNTUlIlsXf8ziAzMe+CwOt/Xh65qdfO:dFKj+9Y0wgUonnYOVXh65AfO
TLSH
T1AEB207F658D74936D99D9B47F73E2E028EBCC167B5812A40B3985A0CCD8B2BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 b4b07bb468baf05925b3cd4dac126beb9dff68755c0a003549ad595510acfd4d
MD5 f586778075bd9d77db5605455707f0ba
SHA1 165a14293c39cdc054de42fd1d2bfcdf815a6b77
SHA512 54b91f70f51d17ff613cee3d8d589ca6de570941c4b935ac12c7e3233e7c642019037bdc786f01ad5734d71380f4e110d902d5cbe25fa1d3060966a5075ba719
SSDEEP 384:utNn/s3n9SusNnsXf8ziYTMe+CwOt/Xn5qdfO:uj+9B1ohnYOVXn5AfO
TLSH
T19A727C366C794E675EE2A595F50B36179FB48167A2862F80D4ECAF0D02CF3AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fb8c7af8981920b29cd7d7f36b6d4e3125461a96b9d219df7b4c91cc37dd7f67
MD5 48015f5b96aae6aa3f54bff15f039daa
SHA1 ae008e130c56891b54dae2c43236ffa88609b194
SHA512 4a409a859521f0e02b44cba8820583acd27a5326d062c3e2def8d06eddfac2b2523d5ae4751aa2057de1c18339597b7a5035689014df61195576fe2e062545a9
TLSH
T193E00955A208153BC439173201C31B307BF081014BA312864720427C3C223012B71AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a62a28e6d0dd9de239e844c19b3cace7036f83da39ede07bbd972773047f78e1
MD5 af9e82f6234bb95d7bbead4b19b71ee4
SHA1 d884366abfc79746cbc0003036d744b0700ab4f2
SHA512 edea5eeb7567f261fb2bf94dbf53c717c3964fc9c90a5113a603b076af664dcd7deda829d920234d742aef952dc5d74804e951e6810fc423c9f788ba7084a56d
TLSH
T107E00486A20455BBC439573201C71B30BBB292114BE716AA5B2492792C727153F71AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 77b582be08272a3d67264242a0aa92834631c5a7476b32cf45da67d4d247fb18
MD5 0b173fc6c74e80bde05481c984c134f3
SHA1 b0642a82a85363d3235d0b390025ab4ef1941163
SHA512 f0319e19ce1252226a6da4689f2a3f1ec62978641e0a04a3011c9b6edf32314a70997a210802469ddc24a86617c37168b235f2eb48c3dfc69d1526b637557205
TLSH
T1AAE001459300152BC435173200C31B303BF0C1014B631387472042783C223012F615C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a85cf09b16b939e9ee671987564bbb6678df8eed38bbc15632c81024845a9a85
MD5 3278dfdce5989c67e7f8f4d075e24a24
SHA1 422bd48572cdeeeb3092ec40324ad97a21552f2b
SHA512 2e6d1d66a50b7148db6ea6e463b75fd48bc0057c1ecb9ed478e835e86da85719c7e1b9f702a1a457269a4d4683e60a4f7812b17a7ba4a11b0c282eb7e6cbbe39
TLSH
T10DE00946A304157FC439573201C71B30BBB181114BA312A74B2042783C727113F719C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f26c91aed25c19c02c4db838b51f5e838bcdeb2c6dcb9428367c9fe1f7e16958
MD5 5028cf84bd61d8709f8805ef8a2b577f
SHA1 93ba47be0765eccc0df0e1b09f7d301c1401d083
SHA512 35e50dfbc074fd593d3d2089c89cfcaa17b8594c6fe833a6c7d2fd23d7b6a0b98f2266c493f525835657cc1c3826a8c4cbacff361b682477480e2ca6bfbc3bf9
TLSH
T120E00486A30865BBC439573201C75B30BBB292214BE716AA5B74927D2C32B143B71EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c1553f21003450bbc4aa133d1fcc534395c49731d9c4caa8fdbd86acb1a0aeeb
MD5 383c63b20da0ff56b0bdc2022cbe2af1
SHA1 b1c57577bb52ca4512522a773dab183be4900585
SHA512 6b53b30d144618cc06038d5fb3b64da4b2baec354690bc4f7ba01c4c3a0dee3d2f4f30257cf05cad2c9d030539b08b21cbc5a7ca92aa9c1f9a2143c337276689
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c955cdbf2070e7bc085607abc028a8af178ec36be58bfa9afe544dbb5aa27d56
MD5 6fb03cc2f8ffae8fffc20a473a0a1c13
SHA1 4711507b0eba4577dbd8f4dbf4722123f4c6ddaf
SHA512 48c55e0fb7b1a85bb5f4fbf0768686224ba36ca9b8603b4cc3307f139a0fe73ecd6736a2cc962add674c5816663a9d4274919dd2714d7c8050f4f8113bc5ea0e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58ce28.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58ce28.TMP
Size 392B
SHA256 9f658c848e9feb9f1528f7f420e344a0da12088cce5990b715b44fd4b2aed1cd
MD5 71ce12e08cd020cb15cb8d86139a5b7b
SHA1 a5a59314c751a23633f5473168e17a31f611be68
SHA512 aaa5dc2933800cdcc6370050ca357da5bf0acb8fc7828683e1cba961bbcbc629712cf2245ae3acca2504f85d0292b1a1edc016b0eeb99f89d44af195200e0287
MD5 SHA1 SHA512

Submit Download

23ff1185-dd23-489e-8f69-b17d3a15c6f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23ff1185-dd23-489e-8f69-b17d3a15c6f4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8614eba3decce03c9a9761f43675e188422dfc6858b57444a0e05276f6047bdd
MD5 fd03fa4c596ac4df2c8bfeb217c05007
SHA1 246b01a989938ae92c7323f3e37527b6dac25554
SHA512 50cb0bb91f0ee557ae46660aab24f157cbbd7683c8cfa986e6ac2d1a3cdbee08a254b32a6023498bfafd685852babcfcc2e98879b5436af08ff0b634ac12a65c
TLSH
T110412789A6EA1148F3B77E5AAFF7A86D447BB8332F0AD05D10000E4E0676B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

Hello.bat

Path C:\Users\Admin\AppData\Local\Temp\57BB.tmp\Hello.bat
Size 1KB
SHA256 d1d5d567206e1ba5e3d8ef3a20620b76389961ce199ba6400d24b4ad088f4a38
MD5 7bdd9653e6e737e1ca6dbb89a2e994b6
SHA1 cccd6efe65593c1f4cdc97204314f31bb521a68c
SHA512 9e50538a826e0747a1623fa9570768692c29af08a813497442f5f9a21f553ffe30aa6783558568a7a44599a082e7a9fc261bfb90d195e2a3ac1774888c5daada
TLSH
T173313E7A2E175001A8E42F6E9A6B33C19DCBC06B5C3852A36435DDB0A51F54FCDA63CE
MD5 SHA1 SHA512 TLSH

Submit Download

6267.vbs

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\6266.tmp\6267.vbs
Size 588B
SHA256 6ca9f5030f662590a661e784d77bc8d224f08b5299e7ccb1377c990e486ea246
MD5 4c6d5dd561adb7629e339d123f6f522a
SHA1 955b195dde502b0a31eeae4889be600b6544abd7
SHA512 e5d3d7c4eb5266619ec6326f5ba15c6cd3e0684b7f63daf38dc49fff26d9d73b95258d631b8382354d0b33f08e9bfdb71d6e8c440bbede7f35de4953d4ed410e
TLSH
T1ADF0BE1293D60015B5B52F4AAC3111740A23FEA2D83DE24D00882C0E9FF3904CC757B3
MD5 SHA1 SHA512 TLSH

Submit Download

HungadianMBR.exe

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\HungadianMBR.exe
Size 47KB
SHA256 f6d3d1d53a69c9616952256e5220dffbe50acba9a0c33ad3eecf2e0982ab99c3
MD5 94f0a37a156ad0cbf224fd825753e05c
SHA1 ee61a6a3a82b47fda285708236d7036e252fe473
SHA512 6057a610c0bdb0be30bb0466b28d7d6a0851d0bd112df32c9119655852314215ccabd779c04517cbfc6317ac3d94ba1ab133dd75c70f0a1f086b4b45b66c36d1
SSDEEP 768:9yLqzcQ8zwtHEBbGoaPbs9IKRQ5qo2GLQdJi34ztOyjg5YCtKO:cLqzcQ5kJxWpKRfzdJhIyjg57K
TLSH
T15E235B07F6E28C39F0619BF85C34D6D9FA37B8703D792269A7645B8D8C1A2D16C98343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PatBlt3.exe

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\PatBlt3.exe
Size 104KB
SHA256 b41d36f67e147133f8c3aa054b52275f68d7e2735a65eb3abcdcd08bede1100b
MD5 08e74e5f077f0337d0c0d15dde94f8be
SHA1 d5ba49b2ddfe50ea4b214e0f447cbed7fb949279
SHA512 f102a81b56c053a7c492a0459f9e7410346949074fc68e733ae9174651bb0265266560526782fe1e95cb2769f54fca3071f56839126d9fc8d7266828b9228fa1
SSDEEP 768:uyJybtwpM91ivG45l+fCZ3MTcB7pYc7LmyyHDOJxO5o7u3yUyJCbYt0G7bbuLcDA:C5iTyi+crYHyKDOVu3yUyJCbYt0G7bHk
TLSH
T113B3E6D7BE8AEDA3F925173989F68319033DF7C01B828B171D31993A1B136A17EC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bsod.exe

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\bsod.exe
Size 102KB
SHA256 b1459f6ade9be379c20ce8fdf65f425e241ab96c8e799de25c352b7dd0978d47
MD5 30c6ece6db96626bae93be86db0990e1
SHA1 02a452be27b46474fca6d82580ffe76133aff5a3
SHA512 96b866a0d965f268ce5453156866b39972a59478ce25f5c228659f774643d2739b4f0081077f19bc55a3f1ef18091a2b1a16053a69588f3e15a583ab9b7136f3
SSDEEP 1536:545iTwUcIYgyL6Onu3yUyJCbcVjc7ACwG:5JMUciyLZpDlG
TLSH
T129A319D7FA86ADA3F925173989F58319133DE7C00B828B171D31993A0B176E1BFC524A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytebeat1.exe

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\bytebeat1.exe
Size 102KB
SHA256 41ac58d922f32134e75e87898d2c179d478c81edaae0d9bc28e7ce7d6f422f8b
MD5 6b673ece600bcc8a665ebf251d7d926e
SHA1 64ef7c73a713bf3c55fb4ac4e5366a7a425f1b4e
SHA512 feb18a1aa72de47fd67919e196abd200afdf22ad5a7e5dac20593252d8b2ca86982bb07c2fed3681ef06c9933c6d197590c1df65aa5df93cb6abafca5e53e9ff
SSDEEP 1536:FlU5iTH9c7Y4yXKOau3yUyJCbgwmw7LgBB:FH79c/yXyJrD
TLSH
T14CA308D7FA86ADA3F925173989F58329133DF7C00B828B171D21993A0B176E1BFC5246
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bytebeat1.wav

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\bytebeat1.wav
Size 1.3MB
SHA256 4599f6f06c7f491a50e3c4012a83cce9f3ee13ae209189cb8964f0b6ba14614c
MD5 09d2094f56d2d38aa64eac1d90c5a554
SHA1 c6268759b1eee9fdfafa0d605d62bbbf85defbca
SHA512 4ca756a06612c281ec03dd9f064b9ddaf6756b00a5d54dee62728f5cdd7ad3d928559b9857ed2f733b8b3e842b396fed94b212ef2a384265ac623433d67010f3
SSDEEP 24576:QWLbSujLfL7L/3LbjLXzjXXjzPbxNTHzXdHHHDHHHLHHH3HHHfHHHHHHH5TjTzLa:QWLOujLfL7L/3LbjLXzjXXjzPbfTHzXy
TLSH
T1DA557C400C3E555EF432B9AE5CF59D04C36F12E58291B222887FD0AA79D7BD943ABC87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mousedraw.exe

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\mousedraw.exe
Size 104KB
SHA256 9bbce9c9e1b513084b8a206e935b2512a341fd81688e71735ef27511d0378d47
MD5 f7db0edd465e545dcd947f4beef32779
SHA1 a02d2dcbe4ea1146b726a6191354340f8dd41f6a
SHA512 6d40cf365a30277328f9103083e939ac8fedf860ffef6d0c5bd80d708e0f73d606f456d37aa1fa5e69964ac2e20c263fbaa755a9c28eff962395e3509a7a4e25
SSDEEP 1536:h5iTgocXYpySNFO8u3yUyJCbAV0R7nghC1ed:i8ocKyStOV5ed
TLSH
T190A307D7BE8AEDA3F925173989F58319133DF7C01B828B171D21993A0B136A17FC524A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\note.txt
Size 46B
SHA256 b2ee3dc906cf3cd5e03c50a7c8a0aeb8f0a841f7ef518085a4cea88ac9cdd5a6
MD5 7412f9eb5d8c606cec6baed837c82e8c
SHA1 4c2a6319a1187c0c79c7992f85e63c89c2f4573b
SHA512 266d42e4b9721ce40e9d9c30108c939aa53ac5e0676b460c26a85b3b3c72759d8a2b9003ee2a8a242591cd8af349ee0c81354f06a6dd1536f250fc1e39e1001d
MD5 SHA1 SHA512

Submit Download

ur.cmd

Path C:\Users\Admin\AppData\Local\Temp\6265.tmp\ur.cmd
Size 395B
SHA256 66c476efaeb7766cb70943b96c35eb4c4e0ccdc28cdcf6977dd4feb5854ffcd1
MD5 4e42b6ba66f002a884e5c779c6abdbec
SHA1 de674ac5186f864d6ab837df792452bd1bf09235
SHA512 3d6319f13e136f81ae7e3e9a9f4fbaff4db5485e1f7f39f1e251de95a80d48dfbdbe3d49a3b6976f1b2b62c81c06aa5e3f38f93645b10eedf714a2de19ba3cd9
TLSH
T19DE068AA5D8A60C0D8D89A6E065777C07B7B818F0873C882249B1064458FA89A43C2D7
MD5 SHA1 SHA512 TLSH

Submit Download

A6E2.vbs

Path C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\A6E1.tmp\A6E2.vbs
Size 998B
SHA256 96db126459d91c400c64675ca2c4ce5e06bc1ba83b4e8a8d258be1dbbfce0167
MD5 c289227e02f0286da14b276ce69813f3
SHA1 061712bb11a33f39ae7a63ccdcb7dce3bbf6c68a
SHA512 1f45e15d85a8d45ffbdd200940ec19830e4ce7147c9f1873ba51cbd261a188f9d38c8ddb426188a78e2a0f21d3dad6da8cefe38a05f93e5539fc92d6fcc1a4b5
TLSH
T13711391253F64115F2F53F85AC7605350A37BEE2EE39D24C0648280E9EB2A44D9B1777
MD5 SHA1 SHA512 TLSH

Submit Download

bytebeat.exe

Path C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\bytebeat.exe
Size 102KB
SHA256 7a5b8795aed94dca80cc5e956f1b409135735637cc556c7b533acd6b2fbaee58
MD5 445d48408fd9cb1bcadfb8243027a12b
SHA1 cb1382d3870a4a821ce8e731d9401f7ba0c0da40
SHA512 b89d121f13a574d6b51125cb7b35ad68af22eeaa7b68b8cfbdcbdd228b941235a8a841906023274d93ee68ab64ca59251f6f7ffb2b59034616879e111359297f
SSDEEP 768:0v95ybtwpM91ivG4+l7fCwjfecgAxpYcw+7yy5qOyWOjonu3yUyJCbfw287RwuBU:t5iTEUcbYiy0qODu3yUyJCbfw2872WU
TLSH
T1D8A307D7BA86EDA3F925173989F58319133DF7C40B828B171D21993A0B136E1BFC524A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cubes.exe

Path C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\cubes.exe
Size 103KB
SHA256 2d3e7cdbf244704934afa447552c049a891a9ccbd6d4ab42ca2504ad0a99e803
MD5 ed695dac2b14ccad335e75f5ddd44139
SHA1 35f4fae272c9b8dc84ffdae9b4dbfa4ed32936eb
SHA512 a028c258cc65e208303f458279035d430f8447c6ca950d2de9c345aa7c2a13cff3a36fefdeb9305f8caaffc7da91fff91e05ef8e52b9d3672f7a71b49bbf47d5
SSDEEP 768:gX5ybtwpM91ivG45l+fCZ+TcOqpYcaBTZyyH3OB4O2oBu3yUyJCbEV7c786yo5cE:D5iTyZcLY5y63Ohu3yUyJCbEV7c78/6
TLSH
T17AA307D7BA8AEDA3F925173989F58329033DF7C01B828B171D31993A1B135A17FC524A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbr.exe

Path C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\mbr.exe
Size 47KB
SHA256 4df6726b7f4b6cdf8704a77e8c02ff77b7d343d0dfee72dd47b87c24149770e8
MD5 51c36b00e027c18d1c48ba90483e6c78
SHA1 c0736ec2c98faef2801c817e1e37f62143a117ab
SHA512 d3dd0b8012ba18e5f56ed8499bd6468c634273271b454b2c8244c274904d947afb7e1be131c76104308840f831eef64a2ff93843befdb03a0d75d135b6fc036a
SSDEEP 768:9yLqzcQ8zwtHEBbGoaPbs9IKRQ5qo2GLQdJUL4ztOyjg5YCtKO:cLqzcQ5kJxWpKRfzdJTIyjg57K
TLSH
T11F235B07F6E28C39F0619BF85C34D6D9FA37B8703D792269A7645B8D8C1A2D16C98343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ur.cmd

Path C:\Users\Admin\AppData\Local\Temp\A6E0.tmp\ur.cmd
Size 667B
SHA256 7accd66d00ad98127a4d36faf732ffec2083f8cae4c2d568d6d8af94b15c0ad5
MD5 0faa734bb197405f17b28ef17f136a98
SHA1 2d8e4d89cfedd7c297ee15da6e0d1073f4665d6f
SHA512 63ededef1d17ca8636640c38041672ada5cd239bf004eee2211d5c933df874fdb55d35e6204a77df63eebc8b6952303d1a900614aa05ecc7094f9c30ecff81d0
TLSH
T1FF01F67E0C57A444E8E81B8D919B27C1FA17E16E48B89152B4366478301B008D96B3CF
MD5 SHA1 SHA512 TLSH

Submit Download

Hachi.cmd

Path C:\Users\Admin\AppData\Local\Temp\CB0B.tmp\Hachi.cmd
Size 1KB
SHA256 8cc52412c5bc03a43f5389bd27f5efd6e3fb50cb26f9bb06e7ebcc2d49ecf8c2
MD5 736d5dc44aa01f987c248006eb48adcf
SHA1 12e1f16c349461c17e8291ff709b87f1eb46743e
SHA512 8dff07e6d470ce6df9f744f6e9852a4d8c0849554b0e1708873b5d86c54a93a925e23634a5a053f99c7c4a328945cc73219ac731063af92057a6c22b068d0f03
TLSH
T16E3156A33BC8B0085CF956854CC77241E503FC7F91645C1FB76606F9683E188BA6B395
MD5 SHA1 SHA512 TLSH

Submit Download

note.txt

Path C:\Users\Admin\Desktop\note.txt
Size 47B
SHA256 49bdfe3b618a9f4946596ac870a3a50255ec648be6a567b7ab24719d159c7951
MD5 2127d219c3c6f9f70ef98cd7fb491505
SHA1 c62dfe0593eb20ad5d86b6785b816f08375aff73
SHA512 fe936b952dcba96fdb91bb5c8c6aaccd09c24094721ea4542202989bee9b13bcd19bd57b4edf69efdda274593376c036202ea01296241603af9859962235dd8a
MD5 SHA1 SHA512

Submit Download

Hachi.exe

Path C:\Users\Admin\Downloads\Hachi.exe
Size 23KB
SHA256 fe3b1e33c5407ef124053d86837c81eb617eae12d3e7d2bd779abf0bbe51d11f
MD5 5e040824d125d4713300fbba29d56f9f
SHA1 f5031b609b1cf721af36d7fe126ced2a88b428af
SHA512 6036b48061c684257ac25f39ffe15ec8afd67e01147a3008b120918a367539733203ff378f818cbd0664b6f9f47f2feddbaf5bb20dad0b2a0b753c8d069496ca
SSDEEP 384:4jQkZbV8i+fIZFQyZpz0q7bYKkxRjK36ct14yvXbB75zx+96UX2baNJawcudoD7x:nGcAPQIpz0Mb18Kdt14yvLhlxrf+nbcv
TLSH
T140B2D057E6B5C788C81E91FD00DF6AFE1011E21DAB884A56B8FC343B7F05B90690F691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hello.exe

Path C:\Users\Admin\Downloads\Hello.exe
Size 32KB
SHA256 2ae61b80c3fdbc22370ac4c8ad613948e414d6fba79b02d4014ff7b667f9d352
MD5 ac862dc90e5aac195a80f025bd25c8f5
SHA1 8d876840d82d1bb5cf7d7b89f8809e956bc4e09e
SHA512 dc148090efc3d6f72a364beed6ad67ccfd55c22d83ad9a14b9397d1e54ced4dfe890fb91ad7f015eb72dad12de14e9e1f212fc004e7a8fa67ea83c31caf494dd
SSDEEP 768:tGcAPQIpz0Mb18Kdt14yvLhl12nbcuyD7Usl4:h3TMb1FpPtmnouy8sl4
TLSH
T1C9E27B62A5548E85F40E80F90C5BB7B90701F939A8DB86D2A7F428ABDD14ECC7F09461
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Holzery.exe

Path C:\Users\Admin\Downloads\Holzery.exe
Size 2.0MB
SHA256 ff7e96e2b4b49e5d400cce37e54e56a879d553299f059d4bdb8cb39f65837bf8
MD5 1c0f68aaae136768fa610dab729e7644
SHA1 b9e913077a3e239cf27ea5e508dec5127154b2d8
SHA512 1ac8260a8670502d34c16f072f8830451e48ca80d29114a9d5b4a4edd60b6c130d17e89f2912a3e7867825cf4baa6f6dfa11be9922187bd955ff5bed228664dd
SSDEEP 49152:P7NNaPTPy+t2sGB2VwPn56Hs9CqpX9nwSKqjkJUhgXNnQuUb+ZOQLKXJiHdY0NsK:T6Pyd1B/RusQ8NnwhJUhg9nNUUOCKXkF
TLSH
T195958EBBD8E6635E9ED083EB5C9CAE73A2E33708D253890C5194338A47259DD0B5E4F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HtkLkr.exe

Path C:\Users\Admin\Downloads\HtkLkr.exe
Size 135KB
SHA256 6f79701f7503dc110721f7a01bf08f3593bd2eae1daf946dcefef14d0c7f9ed4
MD5 2513f7a3546fd5f5d2517922439f7fa9
SHA1 53cb7bc08d1b2604803646d5d0404bca3cf8eb08
SHA512 bf1f9d01a1f781b053233621b73212fad1b65d81e32ad7904ee2cae18f3492f66b4241022c28ee3783716930f4992bcc5f3925e9950e4f70bc7886ccdfe552f4
SSDEEP 1536:XE6fRhLgGImUXz1+MRBl4wjNnEmUoH8B/11t9CY7YQYdLBRVl:06fRxgGImUll7Om7cp1rL7YQC
TLSH
T160D35BBBD8A6636ECED4937B509CFF76A2E33708A2939D0C205433864765ACD0F525B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hungadian.exe

Path C:\Users\Admin\Downloads\Hungadian.exe
Size 490KB
SHA256 51f0b49a899f3c742c06d491f8bb55cc1323a7d3db4295994efe81adbcc54804
MD5 cb734b57c065e6c1dad7840a78cb9f04
SHA1 b716700ef53ecaf001f6d27b20979a4b6266a013
SHA512 89e2de68906cd62f090704a4085a280dfa4a780d8670a03fcf8a6ab11b58f02034f0721d75d6abdb88f0f293b171b202e4ea52e204122c44508cc5e9f7b55c91
SSDEEP 12288:EaNNTToo1zu7bTNHx0bIrqaKWZZRiPSoEgzuc345A9bdfdi:EeTToo1zu7gswioEg/4Sf0
TLSH
T1A8B41201F6E906F3E5E2083640F9786BD235B7289704EDC3C34E3D628AA35D1A7792E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hyptonize.exe

Path C:\Users\Admin\Downloads\Hyptonize.exe
Size 907KB
SHA256 64b99590e569debe44b94a50e660d3f17d0e57da3b51c22ab776728c8ed1814b
MD5 3163504f3b52c4f9429f2123ddb73520
SHA1 75a6b52c3bec94193c56d46799d947ad79414159
SHA512 50d21264023befc69324239ef47b61b6530a6a74ff03c3c7725052624cddad7e8748b70692680f1bd4ed1e3db087b68babd0652961c345d5863a706034732516
SSDEEP 24576:UeTi3xshcgAIIy6iEgmtR3aQTxkwmLWcpCmHU:zT2mhcgp37eRKQT+wiTE
TLSH
T146151252A0DD3EEBD972043023B723D9D73DDE289709D8EF978928121AAD5C671353E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/620-857-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/804-891-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1212-949-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1712-950-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1788-975-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1916-927-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2020-880-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2348-976-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2456-974-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2588-789-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2596-881-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3408-948-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3448-463-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3448-440-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3448-404-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3668-749-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/3716-926-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4196-887-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4196-870-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4196-884-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4404-869-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4808-879-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/5080-485-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/5080-522-0x0000000000400000-0x0000000000416000-memory.dmp

Download

memory/5080-547-0x0000000000400000-0x0000000000416000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads