killmbr | 17b1f1e3f6235008152f64ba8b8b4af4abbbeb0150db3ef32eabf04ee3bdc5f4

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MEMZ-Destructive.bat
Size 13KB
Sample260828-vgmt6scm9v
SHA256 17b1f1e3f6235008152f64ba8b8b4af4abbbeb0150db3ef32eabf04ee3bdc5f4
MD5 508ccebebaefb2fb833bf8e7febfa209
SHA1 bc55c719df63e3ebaedb280f25fc1bee5fce9ce0
SHA512 8bc9bfda22a4548c8c445267af32b61f85b663db3cb6fa7cdb5a721964cf36d0b8fe6f07b51451b4bfea16da3c58abf1facf5674638ccb1794707fc10ea91f0a
SSDEEP 192:E7N3ODNPiwc205VjF+Ijytxd+7yxpVtLoTKihWn5hhHxGtHfzf+H/0Nz6hcbXJ:E85qwc35O1+7y/LphxxGtHAhubXJ
TLSH
T132528D3236784E132D3026C99C0AD246FCE463F7362A5E62E413C9FA50AAED3725F705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

bootkit discovery execution killmbr persistence trojan wiper

Malware Config

Signatures

Family: KillMBR
KillMBR is a trojan that attempts to overwrite the Master Boot Record.
wiper trojan killmbr

Detects KillMBR 1 IoCs

resource	yara_rule
behavioral1/files/0x00080000000244ae-181.dat	family_killmbr

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	MEMZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	MEMZ.exe

Executes dropped EXE 7 IoCs

pid	Process
2652	MEMZ.exe
4760	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
632	MEMZ.exe
4044	MEMZ.exe
3376	MEMZ.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MEMZ.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wordpad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2120	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324099534524425"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{9298C70E-118F-4C9C-A5CC-C270F4642D26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4760	MEMZ.exe
4760	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
4760	MEMZ.exe
4760	MEMZ.exe
4044	MEMZ.exe
632	MEMZ.exe
4044	MEMZ.exe
632	MEMZ.exe
4760	MEMZ.exe
4148	MEMZ.exe
4760	MEMZ.exe
4148	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
4760	MEMZ.exe
4148	MEMZ.exe
4760	MEMZ.exe
4148	MEMZ.exe
4044	MEMZ.exe
4044	MEMZ.exe
632	MEMZ.exe
632	MEMZ.exe
4148	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
4148	MEMZ.exe
4760	MEMZ.exe
4760	MEMZ.exe
632	MEMZ.exe
632	MEMZ.exe
4044	MEMZ.exe
4044	MEMZ.exe
4044	MEMZ.exe
632	MEMZ.exe
4044	MEMZ.exe
632	MEMZ.exe
4760	MEMZ.exe
4148	MEMZ.exe
4760	MEMZ.exe
4148	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe
4760	MEMZ.exe
632	MEMZ.exe
4760	MEMZ.exe
632	MEMZ.exe
4044	MEMZ.exe
4044	MEMZ.exe
564	MEMZ.exe
4148	MEMZ.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe
1368	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3376	MEMZ.exe
5416	wordpad.exe
5416	wordpad.exe
5416	wordpad.exe
5416	wordpad.exe
5416	wordpad.exe
5416	wordpad.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 2256	4280	cmd.exe	84
PID 4280 wrote to memory of 2652	4280	cmd.exe	85
PID 2652 wrote to memory of 4760	2652	MEMZ.exe	99
PID 2652 wrote to memory of 564	2652	MEMZ.exe	100
PID 2652 wrote to memory of 4148	2652	MEMZ.exe	101
PID 2652 wrote to memory of 632	2652	MEMZ.exe	102
PID 2652 wrote to memory of 4044	2652	MEMZ.exe	103
PID 2652 wrote to memory of 3376	2652	MEMZ.exe	104
PID 3376 wrote to memory of 4100	3376	MEMZ.exe	106
PID 3376 wrote to memory of 4756	3376	MEMZ.exe	111
PID 4756 wrote to memory of 1368	4756	msedge.exe	112
PID 1368 wrote to memory of 4128	1368	msedge.exe	113
PID 1368 wrote to memory of 2120	1368	msedge.exe	114
PID 1368 wrote to memory of 3848	1368	msedge.exe	115
PID 1368 wrote to memory of 3848	1368	msedge.exe	115
PID 1368 wrote to memory of 3848	1368	msedge.exe	115
PID 1368 wrote to memory of 1668	1368	msedge.exe	116
PID 1368 wrote to memory of 1668	1368	msedge.exe	116
PID 1368 wrote to memory of 1580	1368	msedge.exe	118
PID 1368 wrote to memory of 1580	1368	msedge.exe	118
PID 1368 wrote to memory of 1932	1368	msedge.exe	119
PID 1368 wrote to memory of 1580	1368	msedge.exe	118
PID 1368 wrote to memory of 1932	1368	msedge.exe	119
PID 1368 wrote to memory of 1932	1368	msedge.exe	119
PID 1368 wrote to memory of 2404	1368	msedge.exe	120
PID 1368 wrote to memory of 2404	1368	msedge.exe	120
PID 1368 wrote to memory of 2404	1368	msedge.exe	120
PID 1368 wrote to memory of 1860	1368	msedge.exe	121
PID 1368 wrote to memory of 1860	1368	msedge.exe	121
PID 1368 wrote to memory of 1860	1368	msedge.exe	121
PID 1368 wrote to memory of 3560	1368	msedge.exe	123
PID 1368 wrote to memory of 3560	1368	msedge.exe	123
PID 1368 wrote to memory of 5020	1368	msedge.exe	124
PID 1368 wrote to memory of 5020	1368	msedge.exe	124
PID 1368 wrote to memory of 332	1368	msedge.exe	126
PID 1368 wrote to memory of 332	1368	msedge.exe	126
PID 1368 wrote to memory of 332	1368	msedge.exe	126
PID 1368 wrote to memory of 5264	1368	msedge.exe	127
PID 1368 wrote to memory of 5264	1368	msedge.exe	127
PID 1368 wrote to memory of 5272	1368	msedge.exe	128
PID 1368 wrote to memory of 5272	1368	msedge.exe	128
PID 1368 wrote to memory of 5588	1368	msedge.exe	130
PID 1368 wrote to memory of 5200	1368	msedge.exe	131
PID 1368 wrote to memory of 5200	1368	msedge.exe	131
PID 1368 wrote to memory of 5256	1368	msedge.exe	132
PID 1368 wrote to memory of 5256	1368	msedge.exe	132
PID 1368 wrote to memory of 5512	1368	msedge.exe	133
PID 1368 wrote to memory of 5512	1368	msedge.exe	133
PID 1368 wrote to memory of 5672	1368	msedge.exe	134
PID 1368 wrote to memory of 5672	1368	msedge.exe	134
PID 1368 wrote to memory of 3400	1368	msedge.exe	135
PID 1368 wrote to memory of 3400	1368	msedge.exe	135
PID 3376 wrote to memory of 5416	3376	MEMZ.exe	136
PID 5416 wrote to memory of 5380	5416	wordpad.exe	137
PID 1368 wrote to memory of 5528	1368	msedge.exe	139
PID 1368 wrote to memory of 5532	1368	msedge.exe	140
PID 1368 wrote to memory of 5544	1368	msedge.exe	141
PID 3376 wrote to memory of 5636	3376	MEMZ.exe	145
PID 1368 wrote to memory of 5944	1368	msedge.exe	147
PID 1368 wrote to memory of 5944	1368	msedge.exe	147
PID 1368 wrote to memory of 5164	1368	msedge.exe	151
PID 1368 wrote to memory of 5164	1368	msedge.exe	151

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\MEMZ-Destructive.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Windows\system32\cscript.exe
  cscript x.js
  2⤵
  PID:2256
- C:\Users\Admin\AppData\Roaming\MEMZ.exe
  "C:\Users\Admin\AppData\Roaming\MEMZ.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4760
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:564
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4148
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:632
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /watchdog
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:4044
- - C:\Users\Admin\AppData\Roaming\MEMZ.exe
    "C:\Users\Admin\AppData\Roaming\MEMZ.exe" /main
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\SysWOW64\notepad.exe
      "C:\Windows\System32\notepad.exe" \note.txt
      4⤵
      System Location Discovery: System Language Discovery
      PID:4100
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4756
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch --single-argument http://google.co.ck/search?q=how+2+remove+a+virus
        5⤵
        Checks processor information in registry
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Modifies registry class
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of WriteProcessMemory
        
        PID:1368
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x28c,0x7ff90bd2c188,0x7ff90bd2c194,0x7ff90bd2c1a0
        6⤵
        
        PID:4128
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,3406360278257818806,2902598539230888203,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:3
        6⤵
        System Time Discovery
        
        PID:2120
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,3704294510963917778,13820836570636451771,262144 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
        6⤵
        
        PID:3848
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,14272958156386136822,16121251714552264791,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:8
        6⤵
        
        PID:1668
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,17038429430066521545,12638692953690309228,2097152 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
        6⤵
        
        PID:1580
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,12988407255916368174,8095456903193321924,2097152 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
        6⤵
        
        PID:1932
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,8691553820882950841,4549543367976836618,2097152 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
        6⤵
        
        PID:2404
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,15270179507104877583,5118488722098409186,2097152 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:2
        6⤵
        
        PID:1860
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,5595524174795238107,12247461679133410951,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
        6⤵
        
        PID:3560
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,15147319898680787187,7921053217955389643,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
        6⤵
        
        PID:5020
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5516,i,17333524409127128579,17711909878016783800,2097152 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:1
        6⤵
        
        PID:332
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,8031113599551946773,17625997570791691357,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
        6⤵
        
        PID:5264
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,14913796120729868126,12337985435233389353,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
        6⤵
        
        PID:5272
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,11897064244746684382,10830324477887374021,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
        6⤵
        
        PID:5568
      - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,11897064244746684382,10830324477887374021,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
        6⤵
        
        PID:5588
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4876,i,14740315259374468375,13137731280352747678,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
        6⤵
        
        PID:5200
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4836,i,6769377889621460818,835785058141292032,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:8
        6⤵
        
        PID:5256
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,1582528231684117560,9660487108457860993,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
        6⤵
        
        PID:5512
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,16845863670320981184,6579271201500419462,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
        6⤵
        
        PID:5672
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,13764679266869923039,15519999717077749032,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
        6⤵
        
        PID:3400
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,8892225073323196835,12957488931705211860,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
        6⤵
        
        PID:5528
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,8635346319227042777,5371354669400685109,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
        6⤵
        
        PID:5532
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,5181669242454062881,16824279378807206498,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
        6⤵
        
        PID:5544
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,2866976396951110068,4063747203303544272,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
        6⤵
        
        PID:5944
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,15066139251766569186,14400301785980816168,524288 --field-trial-handle=2828,i,3854628659677897598,4400202324926101052,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
        6⤵
        
        PID:5164
  - - C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe
      "C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5416
    - - C:\Windows\splwow64.exe
        
        C:\Windows\splwow64.exe 12288
        5⤵
        
        PID:5380
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Defense Evasion

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a70ee44d3c2f16e6d85d8cb9fd35c9dbb23ea6ef7281f33d58749ab7b27aef2b
MD5 eb0d4e409479b97fe00523c6604f72d4
SHA1 c6a1e7127b530c58d479ec187b55e10210039cbe
SHA512 fbaa92e20eb9b17695bca88d2c24505c3e1b30bbee400770b049aa8eab9bac84f2851f58708c6e0605b4830ef4038b1876632f2205eff5b0fac05297119c1720
TLSH
T16271613D192608A1D3A1893278CD12807DB1C9EEFE335DAE0179FA70E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596f3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596f3b.TMP
Size 3KB
SHA256 8f15b78c1ebb187693096b740ac4b2d33f3088dabce661a647328478ddfc774d
MD5 f8a9a67349bb18f39d38d73ac60fdea3
SHA1 be467f098ab666ddd647771313a270decf0909fc
SHA512 16ee57344ff9e4dea5da985aac9e042baffc71c1db57d97601ad9cb5dd78b87b3101727d524003d024b6bcec370e35a25662d207774ef06f3cc04dc8e15189f4
TLSH
T16F71523D19260961D3A1893278CD12847DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 45e3862a8d9a7f8f56404f536ccb312a3e8e502720f148354593e8ad04072d7e
MD5 4d88694a73451994db75cd09a5aab69f
SHA1 cbf7cb55f5de6fc0b98a05fd319e5a78214c77aa
SHA512 20dd85b32cdf6a780438974c9108dac8ab7b3277975a13cfbd9f0364a1f781d01695703e90f929f49c4eed6821436b17bb56a02e92b8c6d5aac25676ace542ba
SSDEEP 48:YALlNA6OmV5mABmAKPm7fmAQmAkmVVgyAmCstRs0Vs0bzEs9Vus/uzs6ysWVtsR4:DTOydOSMwirnVzRVhGmitdrB3ViwQ
TLSH
T102B15CB7C3D8852ECC5156F49B267F1FCE2D091842283E5AC4D9AF5B93E2871E10464F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5fc1fec816cfafa744f99c0ac9e11ea0d73323aed28e8321ece38afd0a4d5fe5
MD5 c0cab6e0893ee9979aad7b1df681fd6d
SHA1 51edbcc75cb2593c3c72211cf5ffe22551336d3d
SHA512 a0397be7740b243d197bd93c203dc334ec8fd99a8638135680e0dbe343edfe043ec659bbd3d3bfcaf5706915db93cef178d8c42d345f5f2287e58a906d151514
SSDEEP 192:sxZjRAiv/ffsZsWIdpVjjHW6+WN8wv/YIsWF4Ig4J:sxZjXv/ffsZsXZHbL/Qc
TLSH
T1F222B912AE24A57B8CC7E21DFA15BF13E6F5513291D11E58E6FC8A1C05E7ACD220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2a5745243e45393c3a696f7c8c5ff0d9a6203fa2fdc5ba878118fcf1a4102276
MD5 3f8f702d5236b4183c519aff3d9097ee
SHA1 e6029e391a1100e27d3942e1ba7b3d8c2c399d2c
SHA512 87bc37623732e56b4aa9afa1be37e4b0edef61abd7106963fd95c7472e50910299f9bfdd57e0893bb0f2422941d3523d489586d9aa51a645815ceb0ca90031fc
SSDEEP 192:sxZjRAiv/ffsqsWIdpVjjHW6+WN8wv/YIsWF4Ig5YJ:sxZjXv/ffsqsXZHbL/Q2
TLSH
T1BC22B812AE24A57B8CC7E21DFB15BB53E6F5513291D11E58A6FC8A1C05E7ACD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f484806139ba4a1b5d4ed538bf1ce9b43a6cd70a33ece2de11a06a8eb0a2946e
MD5 3d734ae54f575124a7d75ff835e8d74e
SHA1 53f4ff78380adc9084239109cce3c2eee226cb12
SHA512 c9b405c7c8ae5d78d54a1e051b3fe701588cd1597e8aaf4f9b53e4f038075be559bfe45beb4aff53390c1882d354818713c62afa64168c789196275300126ed2
SSDEEP 192:sxZjRAiv/ffsqGsz71IdpVjjHW6+WN8wv/YIc4SF4Ig5OJ:sxZjXv/ffsqGEGZHbL/ukA
TLSH
T18132DA12AE24A977CCC7E21DFA15BF57E6F5513290D11E4896FCCA1C05E7ACD220B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2d2b9572c950247982cb2be8cd24e87361d83885f9227671450c983c6c343e5f
MD5 9e8ff6b884c865cb3ce6a8b2c51a7895
SHA1 0842413eaf6a918f2665f5ca03af0e9f1762a7ec
SHA512 a56736dc6369ff21c1b371ae3701ed215f0851212f40578d7a868588c508be7cbb5d21869afab96f264252e8d3f264552b9348b0ccec92a459aebeded5d258ac
SSDEEP 192:sxZjRAjv/ffsqGsz71IdpPjjHW6+WN8i3XYIjh4BmF4Ig5OJ:sxZjKv/ffsqGEGPHbxXBhKA
TLSH
T1E632D912BE28A93B8CC7E21DFA55BF57E6F55132A0D01E48A6FCCA1C05E7ADD120741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4440a8aa514d1660888bbe540027024ac9b7eb8fe63202fdae02d0c941cca938
MD5 8f70f1bb607b349b3ac5655e796e095b
SHA1 3620e73d22b3b5c717e0503715630991758cc101
SHA512 8110b31691e2cf5d5bac049865026dc59739164e38c45e198e10eea0c242796a9b35cd3e3323125183fb4146533b1bc09a39ceabc875f191c3685d6bb1ecf1ed
SSDEEP 768:HeyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7YrouxH:HeyqbblWvJDjTu1jah4LAs7juh
TLSH
T176C20A3B654CCB7E4FC00A9DDD5A6FD73E9802C7A6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 d65920bdaeb1ff43cdb772f556410f62c4e35a194718d7a2aef259289db85490
MD5 f948230b4d75a1554f069f96614fdcf8
SHA1 4eca4e0c05112c45d1e122dcccb1c62867e60cec
SHA512 d8f2df4f7dce97e5694c2e8609b2e9e832033eec3abfe7139787f571fded417b2e7280c264826db612a3442eeb34ea1e8d31ed12e5e6cef80c4b27e68c56ea0c
TLSH
T10CB024D001131C05CD0403F034C1445133777C417353444304D1107474315400340704
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fb1b1f53537ebb18a677988ea71b2de5e3b3041db1585b755e26a17e2e3225fa
MD5 6a51387e3428536796340b7c1dd8cfc8
SHA1 f8f487b85e6df4a241b41894054b80c8bb55dc63
SHA512 ea3cb4cdda65705aab21ad1a4abf71e55f2e914af141148d12b7375be7f5e86eaaee524148a5ba9bfe05e066752f500ffb6a7e81066b22bc8f4de0bf810a4274
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLiku:KYbaKYIKOfuKQY+S2gKnKb
TLSH
T101915916757E0242787D2898B3A699374F4632733018A4EF3FB950A24E66E120DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f7e87d7c-d027-4a51-9b89-1b9d39c1bb8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f7e87d7c-d027-4a51-9b89-1b9d39c1bb8f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bb9ef28aa68cd915142d3b2988fef27205881e840ea0e90d2b9deea287a43195
MD5 ec91c285a0455d1f6bd85eea76b124d2
SHA1 91d53352ce289332ff16a8889c2f2099dabc2411
SHA512 a528a1a4861a038159833b2d1041811169f1b9987e7c04bef5c0175791e7d6dec85c650fd68a7575c3ae437b479896a1185b550d478d595acb18880e6552b890
SSDEEP 384:nlZcIhsNhoqmbZ8a1iVRNT6bSY80X1puLOSo6:dh3wHTv1syLOSt
TLSH
T1DC827C72AC745C7F99F6A501F58B321B4FB8822BA6C86E40D5DC6B1D01EF598030B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9552e37a9c700b5f432fe87cac4c6dd47968f7dd159d670ad6a756d214635f99
MD5 dfc7de56a821012c171e37c4796b62cb
SHA1 fc3be060a08631a73ee4c0d2a12e9f3ccf0df63b
SHA512 6d6316ca5009348e47a6159bde11681323238af61647473e9ed5645f9f2e9980b4bdfb17b1adea98da43e4449fa4187de8dffa6ea6a2548940f1c1a6c161b30b
SSDEEP 384:nZZcIhsNhFqmbZ8a1iVRNT6bSY80X1puLOSo6:xhYwHTv1syLOSt
TLSH
T1E6827D726C745C7F99F7A501F58B321B4FB8812BA6C82E40D5EC6B1D01EF598070F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cb742be812279385a0012821fbfb22bfd62005e261100963c01ee8248e7720fc
MD5 907a74f2089dad501c2c1a8ca2746e2b
SHA1 f4f80594b084ee7b97e387afecc56d0aec44d098
SHA512 87c3a4e0de7fe2202e2daf64b1c013545a76269dc823127de36e49674a24799b8f6a77a057292967646089755aa870e9783a7f8dfdd827feff12bc5613849ab1
SSDEEP 192:AONk6JkR8QmiUyGIA++RNKFCk5dZc0vOVcoqbm8U6:AONk6UMhT++RNT6btY8U6
TLSH
T1A512F936A8385C7F9DE3A901F48732175EE5926FEA897F40D5DC1A1C01EF59C130E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 29KB
SHA256 4a233166504eb7e17b82c0aeaaa343652d5aaa0e70b3d8d14b3cceab0f1a2926
MD5 587c23e23a0e9d4a721c78a28101564b
SHA1 055afe6a801a0f485835e413c8d2f2769dd3bb61
SHA512 0e9b05bc34185044f823723e7383f95d92338f5c50fea6d9bb8e3b27be36e0c3664b1e237dd200a7129c5f42b85274537edcb746590377afea25cfe8c715ff90
SSDEEP 384:nfiFvZcIDsNz8TUNTUlIlZqmbZ8amiZDfwZRNT6bDY80X1puLOSo6:qFnDWwgKBZHTg1syLOSt
TLSH
T197D2A4F198E3893BE8AE5783A77E2D468EBCC15375885980B7C81D0CCC965BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92c272c7bdbb996ff33f9bf19f4169c8f0212ce2a11dca114c3db48c224eb0d3
MD5 43bb23ba3518754e6c1d3baba4a411db
SHA1 2b9c3f488f0e2dc29db2eb7c72395a10a11ea8cf
SHA512 279f393732f5050467d71e027fffdb551c930c3a71be03aff32caf23478e687fc599419014e1887b6f48c46fe352b9c05750010340e8b81ffb7335b83619cd22
SSDEEP 192:tONb6JkRtQmiUyxAW+RNKFCk5dZDh3HREU6:tONb6UrdW+RNT6bVqU6
TLSH
T1F9020A35AC382CBB9EF36D05B48737275FA4116FAA952F40D6E81E1C00D769C230693A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1546defa-2d60-47e0-87b8-586c7da7bdd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1546defa-2d60-47e0-87b8-586c7da7bdd9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a6e6e5e0a1caf4144e8ac0207b45e392118eb332b46dfa68cf833bc66621f1f
MD5 d49a80371c4f06becce2770774df4c1c
SHA1 db50361770d52d91391337983c9727933827009b
SHA512 e8f838ea7fd3b491092f22b3f9f2a733dfff97e957d5b840850e1f5aac744a7dfd652835784050c00186d7555e0384b292cdd53bca7f604e0b8783bfa62b865c
TLSH
T111410B58B6F91148B3B77E569BF6686E487F79772E06D05E00110E4F4A62B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

10952b58-a388-4c45-8484-6f73f52cafe4.tmp

Path C:\Users\Admin\AppData\Local\Temp\10952b58-a388-4c45-8484-6f73f52cafe4.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

ba6c0f96-37e6-463a-abac-474443b3e273.tmp

Path C:\Users\Admin\AppData\Local\Temp\ba6c0f96-37e6-463a-abac-474443b3e273.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_1749947770\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1462de1-1d79-4a5c-8dcc-be8cded9dd94.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1368_1749947770\b1462de1-1d79-4a5c-8dcc-be8cded9dd94.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 11KB
SHA256 3c8cea1a86f07b018e637a1ea2649d907573f78c7e4025ef7e514362d09ff6c0
MD5 1882f3dd051e401349f1af58d55b0a37
SHA1 6b0875f9e3164f3a9f21c1ec36748a7243515b47
SHA512 fec96d873997b5c6c82a94f8796c88fc2dd38739277c517b8129277dcbda02576851f1e27bdb2fbb7255281077d5b9ba867f6dfe66bedfc859c59fdd3bbffacf
SSDEEP 192:Ljafl1gt6iUq/l0ZQjGNxYoanyJfjvB0BXmqqTZhXBnaRL9znQ32z8h0:L29mtJUui1any9Bn/RaRL06
TLSH
T12632BF3332B50E131E1037EA9D1BA21B8CF551377B2B1E35D1118EEAA1EED66D283B54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\x
Size 4KB
SHA256 45f18ccd8df88c127304a7855a608661b52b0ca813e87e06d87da15259c45037
MD5 214f98cb6a54654a4ca5c456f16aed0a
SHA1 2229090d2f6a1814ba648e5b5a5ae26389cba5a0
SHA512 5f058b05f166e2688df7b3960e135ada25bbcdfbb62a11da3cf9e70c08c51e5589a1e6ca2250318a694d27197f2c5ba1028c443831c43fba2171ca8e072e9873
SSDEEP 96:2OfjuOV4dI3CMQYGtWJQsRmWZu2Ik6iUqLplsQuK0sIF2jGM:Ljafl1gt6iUq/l0ZQjGM
TLSH
T1DB918EB6A5B89D076B4133F59D2B349F6CD4653B794592498810CCB904FFC0A81CAF38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

x.js

Path C:\Users\Admin\AppData\Local\Temp\x.js
Size 448B
SHA256 aa01b8864b43e92077a106ed3d4656a511f3ba1910fba40c78a32ee6a621d596
MD5 8eec8704d2a7bc80b95b7460c06f4854
SHA1 1b34585c1fa7ec0bd0505478ac9dbb8b8d19f326
SHA512 e274b92810e9a30627a65f87448d784967a2fcfbf49858cbe6ccb841f09e0f53fde253ecc1ea0c7de491d8cc56a6cf8c79d1b7c657e72928cfb0479d11035210
TLSH
T148F0DC1CD210E3DD40B3138E2888E6D892872B5D790BF5771554C0CDD027626126EB8B
MD5 SHA1 SHA512 TLSH

Submit Download

z.zip

Path C:\Users\Admin\AppData\Local\Temp\z.zip
Size 8KB
SHA256 44c1857b1c4894b3dfbaccbe04905652e634283dcf6b06c25a74b17021e2a268
MD5 63ee4412b95d7ad64c54b4ba673470a7
SHA1 1cf423c6c2c6299e68e1927305a3057af9b3ce06
SHA512 7ff153826bd5fed0a410f6d15a54787b79eba927d5b573c8a7f23f4ecef7bb223d79fd29fe8c2754fbf5b4c77ab7c41598f2989b6f4c7b2aa2f579ef4af06ee7
SSDEEP 192:egFudZs7gU52m4qi2hvimtucysYSM3lRNm5wy2k89QPaNmCpCfAKgW:SdZs7n52mbFimtuckPXEKyuGSXCfAKx
TLSH
T11402AED2B15ED3C986DAA1BB449D46D221105A2B2F3DA914CF3D83C73C6D3A6744CA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MEMZ.exe

Path C:\Users\Admin\AppData\Roaming\MEMZ.exe
Size 14KB
SHA256 a3d5715a81f2fbeb5f76c88c9c21eeee87142909716472f911ff6950c790c24d
MD5 19dbec50735b5f2a72d4199c4e184960
SHA1 6fed7732f7cb6f59743795b2ab154a3676f4c822
SHA512 aa8a6bbb1ec516d5d5acf8be6863a4c6c5d754cee12b3d374c3a6acb393376806edc422f0ffb661c210e5b9485da88521e4a0956a4b7b08a5467cfaacd90591d
SSDEEP 192:sIvxdXSQeWSg9JJS/lcIEiwqZKBkDFR43xWTM3LHn8f26gyr6yfFCj3r:sMVSaSEglcIqq3agmLc+6gyWqFCj
TLSH
T180624BCFBE204417D8F0C57530659234DFBACABA1B968EDF9CF91E529AC4C072823265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

note.txt

Path C:\note.txt
Size 218B
SHA256 8e9f20f6864c66576536c0b866c6ffdcf11397db67fe120e972e244c3c022270
MD5 afa6955439b8d516721231029fb9ca1b
SHA1 087a043cc123c0c0df2ffadcf8e71e3ac86bbae9
SHA512 5da21a31fbc4e8250dffed30f66b896bdf007ac91948140334fe36a3f010e1bac3e70a07e9f3eb9da8633189091fd5cadcabbaacd3e01da0fe7ae28a11b3dddf
TLSH
T1C3D0A719040784251C7052D17145A5A09B70562D77F626EB74DC690C212700F0B37C9A
MD5 SHA1 SHA512 TLSH

Submit Download